关于 php:Magic quote 和 mysql_real_escape_string

Magic quote and mysql_real_escape_string

这里是原始代码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

if (($handle = fopen($source_file,"r")) !== FALSE) {
$columns = fgetcsv($handle, $max_line_length,",");
foreach ($columns as &$column) {
$column = str_replace(".","",$column);
}
while (($data = fgetcsv($handle, $max_line_length,",")) !== FALSE) {
while(count($data) < count($columns)) {
array_push($data, NULL);
}
$c = count($data);
for($i = 0; $i < $c; $i++) {
$data[$i] ="'{$data[$i]}'";
}

$sql[] = '(' . implode(',', $data) .", '" . $_POST['custgroup'] ."'," . $_POST['user_id'] . ')';
}

$query ="INSERT INTO $target_table (" . implode(',', $columns) .
',custgroup,user_id) VALUES ' . implode(',', $sql);

//mysql_query($query) or trigger_error(mysql_error());
echo $query;
fclose($handle);
}

但是一旦我添加了 mysql_real_escape_string:

1 2	$query ="INSERT INTO $target_table (" . implode(',',array_map('mysql_real_escape_string', $columns)) . ',custgroup,user_id) VALUES ' . implode(',',array_map('mysql_real_escape_string', $sql));

查询将变为：

INSERT INTO UserAddedRecord (lastname,firstname,ceLL,fax,email,code,custgroup,user_id) VALUES (\\'Last\\',\\'First\\',\\'01122331\\',\\'\\',\\'[email protected]\\',\\'12345\\', \\'\\',17)

我检查了我的 php.ini 和 get_magic_quotes_gpc()，魔术报价被禁用了。

magic_quotes_gpc = 关闭

magic_quotes_runtime = 关闭

magic_quotes_sybase = 关闭

应该是什么问题？或者我应该只应用 stripslashes()？但我认为它只会在启用魔术引号时使用。