PDO::quote
(no version information, might be only in CVS)
PDO::quote --
Quotes a string for use in a query.
Popis
string
PDO::quote ( string string [, int parameter_type] )
Varovanie |
T�to funkcia je
EXPERIMENT�LNA. Spr�vanie tejto funkcie, n�zov
tejto funkcie a hoci�o in� zdokumentovan� o tejto funkcii
sa m�e zmeni� bez pov�imnutia v bud�com vydan� PHP.
Pou��vajte t�to funkcii na svoje vlastn� riziko. |
PDO::quote() places quotes around the input
string and escapes and single quotes within the input string.
Quoting input strings has been a common means of attempting to
prevent SQL injection attacks; however, an even safer approach
is to use prepared statements with named parameters or placeholders
for the input values.
Not all PDO drivers implement this method.
Parametre
- string
The string to be quoted.
- parameter_type
Provides a data type hint for drivers that have alternate quoting styles.
The default value is PDO_PARAM_STR.
Vrátené hodnoty
Returns a quoted string that is theoretically safe to pass into an
SQL statement.
Príklady
Príklad 1. Quoting a normal string
<?php $conn = new PDO('sqlite:/home/lynn/music.sql3');
/* Simple string */ $string = 'Nice'; print "Unquoted string: $string\n"; print "Quoted string: " . $conn->quote($string) . "\n"; ?>
|
V�stup pr�kladu uveden�ho vy�ie bude: Unquoted string: Nice
Quoted string: 'Nice' |
|
Príklad 2. Quoting a dangerous string
<?php $conn = new PDO('sqlite:/home/lynn/music.sql3');
/* Dangerous string */ $string = 'Naughty \' string'; print "Unquoted string: $string\n"; print "Quoted string:" . $conn->quote($string) . "\n"; ?>
|
V�stup pr�kladu uveden�ho vy�ie bude: Unquoted string: Naughty ' string
Quoted string: 'Naughty '' string' |
|
Príklad 3. Quoting a complex string
<?php $conn = new PDO('sqlite:/home/lynn/music.sql3');
/* Complex string */ $string = "Co'mpl''ex \"st'\"ring"; print "Unquoted string: $string\n"; print "Quoted string: " . $conn->quote($string) . "\n"; ?>
|
V�stup pr�kladu uveden�ho vy�ie bude: Unquoted string: Co'mpl''ex "st'"ring
Quoted string: 'Co''mpl''''ex "st''"ring' |
|
Tiež pozri
PDO::prepare() |
PDOStatement::execute() |