好吧,我的帖子脚本有点问题.一切都很好,除了当我输入一个像撇号的短语,例如“这是我的标题”不会发布,把“Heres my title”发布.不知道为什么会这样.也许条带标签我真的不知道,我该怎么办？当它无法工作时,我得到了底部错误消息
} else {
if(isset($_POST['what'])&&isset($_POST['when'])&&isset($_POST['where'])&&isset($_POST['details'])&&isset($_POST['sponsored_by'])&&isset($_POST['collegeId'])){
$what = nl2br(htmlspecialchars(strip_tags(stripslashes(trim($_POST['what'])))));
$where = nl2br(htmlspecialchars(strip_tags(stripslashes(trim($_POST['where'])))));
$when = nl2br(htmlspecialchars(strip_tags(stripslashes(trim($_POST['when'])))));
$sponsored_by = nl2br(htmlspecialchars(strip_tags(stripslashes(trim($_POST['sponsored_by'])))));
$details = nl2br(htmlspecialchars(strip_tags(stripslashes(trim($_POST['details'])))));
$collegeId = intval($_POST["collegeId"]);
if(isset($_SESSION['username'])){
$username = htmlspecialchars(strip_tags(stripslashes(trim(($_SESSION['username'])))));
$query = "select id, Name from users where username='$username' and activated = 1";
$doQuery = MysqL_query($query);
if(MysqL_num_rows($doQuery)>0){
$results = MysqL_fetch_array($doQuery);
$userName = $results['Name'];
$email = $username;
$id = $results['id'];
$query = "insert into events values(NULL,$id,$collegeId,'$what','$when','$where','$details','$sponsored_by',Now())";
if(MysqL_query($query)) header("Location: collegeInfo.PHP?college=$collegeId&message=added");
else echo "Failed to create new Event!".$query;
解决方法:
你不要逃避你的疑问.尝试至少使用addslashes或MysqL_real_escape_string来清理输入. striplashes – 从行中删除反斜杠.使用addslashes添加它们,而不是在mySQL查询之前删除.
