开发者

Wordpress Database Output - Remove SQL Injection Escapes

I'm having a problem using $wbdb. When I insert or update data using $wpdb->insert or $wpdb->update, the SQL injection pr开发者_StackOverflow中文版otection actually inserts the \' into the database, and when outputting that information it has the SQL escape with it. (ie: My Value\'s Escaped).

I know there's gotta be a way to escape this using a wordpress function, but I haven't been able to find it searching google and the wordpress codex. ...So what's that function, or what am I doing wrong (seems like the '\' shouldn't really get to the database in the first place) Thanks!


It looks as if magic_quotes are enabled on the server you are using.

There are a number of SO questions and answers that deal with what they are, why they're bad, and how to get rid of them, so I won't explicitly explain here, but suggest you look at a few of the following:

  • Magic quotes in PHP
  • Work around magic quotes, or just make sure they're off?
  • How can I disable PHP magic quotes at runtime?
  • How to turn off magic quotes on shared hosting?
  • PHP protecting itself from SQL injections?
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜