andrisp Posted July 13, 2005 Report Share Posted July 13, 2005 ir shitaads if (!get_magic_quotes_gpc()) { $nosaukums = addslashes($HTTP_POST_VARS['nosaukums']); } else { $nosaukums = $HTTP_POST_VARS['nosaukums']; } Paarbaudiiju kaa strings izskataas un visi itkaa ir eskeipots, bet.. rinda, kas saakumaa bija, piemeeram, 'tiripiri "Para" piri' datubaazee (mysql) ierakstaas shitaadi 'tiripiri \' un viss.. kaapee taa ? Link to comment Share on other sites More sharing options...
Venom Posted July 13, 2005 Report Share Posted July 13, 2005 tāpē ka droši vien raxti kā "INSERT INTO TABLE SET '$value'" Link to comment Share on other sites More sharing options...
andrisp Posted July 13, 2005 Author Report Share Posted July 13, 2005 hmmm.. es rakstu shitaa INSERT INTO `tabula` (nosaukums) VALUES ('$nosaukums') Link to comment Share on other sites More sharing options...
Venom Posted July 13, 2005 Report Share Posted July 13, 2005 "INSERT INTO `tabula` (nosaukums) VALUES ('$nosaukums')" ja iekš $nosaukums ir raw [tiripiri \"Para\" piri] pārtop par raw k-ko līdzīgu [iNSERT INTO `tabula` (nosaukums) VALUES ('tiripiri "Para" piri')"] vai arī k-ko putroju, galvasāp Link to comment Share on other sites More sharing options...
andrisp Posted July 13, 2005 Author Report Share Posted July 13, 2005 "INSERT INTO `tabula` (nosaukums) VALUES ('$nosaukums')"ja iekš $nosaukums ir raw [tiripiri \"Para\" piri] pārtop par raw k-ko līdzīgu [iNSERT INTO `tabula` (nosaukums) VALUES ('tiripiri "Para" piri')"] vai arī k-ko putroju, galvasāp 19274[/snapback] okei, bet kaa tad jaadara ? Link to comment Share on other sites More sharing options...
Delfins Posted July 13, 2005 Report Share Posted July 13, 2005 okei, bet kaa tad jaadara ? lai būtu skaidrāk saprotams: $value = str_replace( "'", "\'", $value ); $sql = 'UPDATE tabula SET field = "'.$value.'"'; Link to comment Share on other sites More sharing options...
Delfins Posted July 13, 2005 Report Share Posted July 13, 2005 he he, postējot pēdējo komentu uzrāvos uz šitā :) tā kā ne tikai tev ir tās problēmas... lāci, goņi support, lai izlabo... kā nekā samaksāts ir mySQL query error: INSERT INTO ibf_mail_queue (mail_to,mail_date,mail_subject,mail_content) VALUES('php@hello.lv',1121247842,'Topic Subscription Reply Notification','Venom, Delfins has just posted a reply to a topic that you have subscribed to titled "mistika ar " un \', un ierakstiikstiishanu db". ---------------------------------------------------------------------- QUOTE(andrisp @ 2005. gada 13. Jul 11:38)okei, bet kaa tad jaadara ? ----------------------------- lai būtu skaidrāk saprotams: ------------ CODE SAMPLE ---------- $value = str_replace( "\'", "\\'", $value ); $sql = \'UPDATE tabula SET field = "\'.$value.\'"\'; ----------------------------------- ---------------------------------------------------------------------- The topic can be found here: http://php.lv/f/index.php?showtopic=2656&view=getnewpost There may be more replies to this topic, but only 1 email is sent per board visit for each subscribed topic. This is to limit the amount of mail that is sent to your inbox. Unsubscribing: -------------- You can unsubscribe at any time by logging into your control panel and clicking on the "View Subscriptions" link. Regards, The php.lv forumi team. http://php.lv/f/index.php ') mySQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'UPDATE tabula SET field = "\'.$value.\'"\'; -------------------------' at line 2 mySQL error code: Date: Wednesday 13th of July 2005 12:44:02 PM Link to comment Share on other sites More sharing options...
andrisp Posted July 13, 2005 Author Report Share Posted July 13, 2005 shitas man arii raadiijaas, ka atklaaju topiku (un vispaar diezgan regulaari raadaas).. btw, ir kaada funkcija, kas paraada, kaads izskatiijaas peedeejies pieprasiijums datubaazei ? ieksh php.net neredzu Link to comment Share on other sites More sharing options...
Delfins Posted July 13, 2005 Report Share Posted July 13, 2005 shitas man arii raadiijaas, ka atklaaju topiku (un vispaar diezgan regulaari raadaas).. btw, ir kaada funkcija, kas paraada, kaads izskatiijaas peedeejies pieprasiijums datubaazei ? ieksh php.net neredzu 19279[/snapback] nav tādas funkcijas... overraido *_query() funkcijas vai izmanto klases, ko es labāk iesaku arī darīt :) $db = new MySQL(); .... new PgSQL .. new Oracle() .. new MSSQL() attiecīgi vari uzrakstīt f-jas, kurām ir jāpadod lauku nosaukumi un vērtības, - tb automatizēt SQL veidošanu, nevis ar rokām visu cepināt. PS: tādejādi iegūstot DB independant App. (nu ~independant, par sīkumiem nerunāsim) Link to comment Share on other sites More sharing options...
andrisp Posted July 13, 2005 Author Report Share Posted July 13, 2005 ak es muljkjis.. meegjinaaju shitaadus stringus pastarpinaati caur citu lapu nodot saglabaashanai un rezultaataa html izskataas shitaads, kas galiigi nav pareizi <input type="hidden" name="nosaukums" value="tiri \"blabla\""> kaa lai shito atrisina ? negribas izmantot globaalos variabljus Link to comment Share on other sites More sharing options...
andrisp Posted July 13, 2005 Author Report Share Posted July 13, 2005 (edited) par to funkciju overraidoshanu.. mhm.. forsha doma.. buus jaapamaacaas un jaapapeeta un mosh veel beigaas jaauztaisa :) Edited July 13, 2005 by andrisp Link to comment Share on other sites More sharing options...
Delfins Posted July 13, 2005 Report Share Posted July 13, 2005 ak es muljkjis..meegjinaaju shitaadus stringus pastarpinaati caur citu lapu nodot saglabaashanai un rezultaataa html izskataas shitaads, kas galiigi nav pareizi <input type="hidden" name="nosaukums" value="tiri \"blabla\""> kaa lai shito atrisina ? negribas izmantot globaalos variabljus 19281[/snapback] nu blin, jāslešo ir tikai tās quotes, kas tiek izmantotas stringa atdalīšnai iekš SQL. field = "xxx" ... slešojam " field = 'xxx' ... slešojam ' PS: atslēdz automātisko slešošanu. Link to comment Share on other sites More sharing options...
bubu Posted July 13, 2005 Report Share Posted July 13, 2005 Iekš HTML vajag nevis eskeipot, bet gan htmlspecialchars() lietot (" -> " ' -> ' & -> &) Link to comment Share on other sites More sharing options...
andrisp Posted July 13, 2005 Author Report Share Posted July 13, 2005 (edited) nesapratu.. :( tas ir runaajot par to, ko teica Delfins.. Edited July 13, 2005 by andrisp Link to comment Share on other sites More sharing options...
Delfins Posted July 13, 2005 Report Share Posted July 13, 2005 Iekš HTML vajag nevis eskeipot, bet gan htmlspecialchars() lietot (" -> " ' -> ' & -> &) 19284[/snapback] nu tur ir atkarīgs no tā, kas tuiek saglabāts - parastais teksts vai HTML kods. ideāli būtu, ja f-ja pati pārverstu texta nodēs ",' & etc simbolus, bet ja ir html tagi - atstāt kā ir.. citādi tur putra sanāks... Link to comment Share on other sites More sharing options...
Recommended Posts