2 回答

TA贡献2041条经验 获得超4个赞
转义反斜杠(使用\\or /):
INSERT INTO `cars`(`carID`, `carType`, `carModel`, `carYear`, `carBrand`, `carImage`, `carPrice`) VALUES (1, 'electric', 'LEAF', '2019', 'Nissan', '\\img\\Hybrids\\Leaf\\White\\Side.jpg', '29,990')
您可以使用 PDO 将值安全地插入数据库。
$db = new PDO( $dsn, $username, $password );
$carImage = "\img\Hybrids\Leaf\White\Side.jpg";
$sql = $db->prepare("INSERT INTO cars (carImage) VALUES(:carImage)");
$sql->bindParam(:carImage, $carImage, PDO::PARAM_STR);
$sql->execute();

TA贡献1877条经验 获得超6个赞
在插入发生之前将数据变量声明为字符串,然后使用准备好的语句来创建记录。*用于文件导航的正斜杠。
<?php
// Data variables
$carID = "1";
$carType = "electric";
$carModel = "LEAF";
$carYear = "2019"; // this column should be set to int as the year is a whole number
$carBrand = "Nissan";
$carImage = "/img/Hybrids/Leaf/White/Side.jpg"; // This column should be set to text so the slashes can be stored
$carPrice = "29990"; // This column should be set to float(7,2) which allows a max of 9999999.99
//Insert
$insert = mysqli_prepare($con, "insert into cars (carID,carType,carModel,carYear,carBrand,carImage,carPrice) values (?,?,?,?,?,?,?)");
mysqli_stmt_bind_param($insert, "sssssss", $carID,$carType,$carModel,$carYear,$carBrand,$carImage,$carPrice);
mysqli_stmt_execute($insert);
?>
- 2 回答
- 0 关注
- 261 浏览
添加回答
举报