我收到有关mssql_real_escape

问题描述

|| 请帮助解决此错误：

Fatal error: Call to undefined function mssql_real_escape_string() in

代码：

<?PHP
$host=\"-Removed-\"; // Host name
$username=\"-Removed-\"; // MysqL username
$password=\"-Removed-\"; // MysqL password
$db_name=\"-Removed-\"; // Database name
$tbl_name=\"USERPASS\";
$tbl_name2=\"EMPLOYEES\"; // Table name

// Connect to server and select databse.
mssql_connect(\"$host\",\"$username\",\"$password\")or die(\"cannot connect\");
mssql_select_db(\"$db_name\")or die(\"cannot select DB\");

// username and password sent from form
$myusername=$_POST[\'login\'];
$mypassword=$_POST[\'password\'];

// To protect MysqL injection (more detail about MysqL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mssql_real_escape_string($myusername);
$mypassword = mssql_real_escape_string($mypassword);

$sql=\"SELECT *
  FROM $tbl_name U,$table_name2 E 
  WHERE U.EMPLOYEE_ID = E.EMPLOYEE_ID
  AND USERNAME=\'$myusername\' 
  AND PASSWORD=\'$mypassword\'\";
$result=mssql_query($sql);

// MysqL_num_row is counting table row
$count=mssql_num_rows($result);
// If result matched $myusername and $mypassword,table row must be 1 row

if($count==1){
// Register $myusername,$mypassword and redirect to file \"login_success.PHP\"
session_register(\"myusername\");
session_register(\"mypassword\");
header(\"location:login_success.PHP\");
}
else {
echo \"Wrong Username or Password\";
}
?>

。感谢您的帮助！一直试图永远解决这个问题。

解决方法

如果您使用的是MSSQL Server，则没有mssql_real_escape_string，只有MySQL和MySQLi拥有它，至少我没有找到它： http://php.net/manual/zh/book.mssql.php http://php.net/manual/zh/ref.mssql.php ,那是因为没有任何名为mssql_real_escape_string的php函数 ,不幸的是，到目前为止，PHP mssql扩展既不支持参数化查询，也没有转义功能。您必须编写自己的转义函数或使用类似PDO准备好的语句的方法来防止SQL注入。

我收到有关mssql_real_escape_string的错误

问题描述

解决方法