AJAX 不会将带单引号的数据插入 SQL

Question

我有以下变量从 HTML 中获取数据：

    $workcarriedout = trim($_POST["workcarriedout"]);

以下语句将此条目插入 SQL 数据库（不是 mySQL 数据库）：

$stmt = $db->prepare("INSERT INTO [dbo].[server_log_entries] (work_carried_out)
                    values ('".$workcarriedout."')");

在输入到变量中的数据包含单引号之前，这非常有效。

有人可以告诉我如何使用单引号导入要导入的数据吗？

编辑：如果这有所不同，这里是代码：

<?php
require_once('../settings.php');
// Get the form fields and remove whitespace
var_dump($_POST);

$datetime = trim($_POST["datetime"]);
$servername = trim($_POST["servername"]);
$carriedoutby = trim($_POST["carriedoutby"]);
$workverifiedby = trim($_POST["workverifiedby"]);
$authorisedby = trim($_POST["authorisedby"]);
$workcarriedout = trim($_POST["workcarriedout"]);
$howverified = trim($_POST["howverified"]);
$reason = trim($_POST["reason"]);
$impact = trim($_POST["impact"]);
$rollback = trim($_POST["rollback"]);


try {
    $db = new PDO(DB_DSN, DB_USERNAME, DB_PASSWORD);
} catch (PDOException $e) {
    echo 'Connection failed: ' . $e->getMessage();
}


$stmt = $db->prepare("INSERT INTO [dbo].[server_log_entries] (date_time, server_name, carried_out_by, verified_by, authorised_by, work_carried_out, work_verified, change_reason, perceived_impact, rollback_process)
                    values ('$datetime','$servername','$carriedoutby','$workverifiedby','$authorisedby','$workcarriedout','$howverified','$reason','$impact','$rollback')");

$stmt->execute();



socket_close($socket);

?>

Answer 1

尝试此代码转义单个代码，然后插入到数据库：

$workcarriedout = mysqli_real_escape_string($db, $workcarriedout);
$stmt = $db->prepare("INSERT INTO [dbo].[server_log_entries] (work_carried_out) values ('".$workcarriedout."')");

Answer 2

字符串中的引号破坏了 SQL 插入字符串。为了避免这种尝试：

$escaped_string = $db->escape_string($workcarriedout); // does the job with the quotes

$stmt = $db->prepare("INSERT INTO [dbo].[server_log_entries] (work_carried_out)
                values ('".$escaped_string."')");

Answer 3

$stmt = $db->prepare("INSERT INTO [dbo].[server_log_entries] (`work_carried_out`)
                values ('\'$workcarriedout\'')");

我测试了它，它现在可以工作了

出了点问题，但我看不到是什么，您和我的查询之间的唯一区别是

(`date_time`, `server_name` etc..) 

这是我的查询，它有效：/

$stmt = $db->prepare("INSERT INTO zeljka (`name`,`lastName`) VALUES ('\'$st\'', '\'$sta\''); and it works :////

screenshot inserted data

Answer 4

你可以这样使用：

$stmt = $db->prepare("INSERT INTO [dbo].[server_log_entries] (work_carried_out)
                    values ('$workcarriedout')");