問題描述
對于這個查詢，是否需要使用mysql_real_escape_string?
For this query, is necessary to use mysql_real_escape_string?
有任何改進或查詢沒問題嗎?
Any improvement or the query is fine ?
$consulta = $_REQUEST["term"]."%";
($sql = $db->prepare('select location from location_job where location like ?'));
$sql->bind_param('s', $consulta);
$sql->execute();
$sql->bind_result($location);
$data = array();
while ($sql->fetch()) {
$data[] = array('label' => $location);
}
在這種情況下，查詢速度很重要.
The query speed is important in this case.
推薦答案
不，準備好的查詢(如果使用得當)將確保數據正確轉義以進行安全查詢.你有點正確地使用它們，只需要改變一件小事.因為您正在使用?"占位符，最好通過execute方法傳遞參數.
No, prepared queries (when used properly) will ensure data is properly escaped for safe querying. You are kind of using them properly, just need change one little thing. Because you are using the '?' placeholder, it is better to pass params through the execute method.
$sql->execute(array($consulta));
如果您將其輸出到您的頁面，請務必小心，數據庫清理并不意味著它可以安全地在 HTML 中顯示，因此也可以在其上運行 htmlspecialchars().
Just be careful if you're outputting that to your page, database sanitization does not mean it will be safe for display within HTML, so run htmlspecialchars() on it as well.
這篇關于使用準備好的語句時是否需要 mysql_real_escape_string() ?的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！