PDO::quote
(no version information, might be only in CVS)
PDO::quote --
Quotes a string for use in a query.
Description
string
PDO::quote ( string string [, int parameter_type] )
| Warning |
This function is
EXPERIMENTAL. The behaviour of this function, the
name of this function, and anything else documented about this
function may change without notice in a future release of PHP.
Use this function at your own risk. |
PDO::quote() places quotes around the input
string and escapes and single quotes within the input string.
Quoting input strings has been a common means of attempting to
prevent SQL injection attacks; however, an even safer approach
is to use prepared statements with named parameters or placeholders
for the input values.
Not all PDO drivers implement this method.
Parameters
- string
The string to be quoted.
- parameter_type
Provides a data type hint for drivers that have alternate quoting styles.
The default value is PDO_PARAM_STR.
Return Values
Returns a quoted string that is theoretically safe to pass into an
SQL statement.
Examples
Example 1. Quoting a normal string
<?php
$conn = new PDO('sqlite:/home/lynn/music.sql3');
/* Simple string */
$string = 'Nice';
print "Unquoted string: $string\n";
print "Quoted string: " . $conn->quote($string) . "\n";
?>
|
The above example will output: Unquoted string: Nice
Quoted string: 'Nice' |
|
Example 2. Quoting a dangerous string
<?php
$conn = new PDO('sqlite:/home/lynn/music.sql3');
/* Dangerous string */
$string = 'Naughty \' string';
print "Unquoted string: $string\n";
print "Quoted string:" . $conn->quote($string) . "\n";
?>
|
The above example will output: Unquoted string: Naughty ' string
Quoted string: 'Naughty '' string' |
|
Example 3. Quoting a complex string
<?php
$conn = new PDO('sqlite:/home/lynn/music.sql3');
/* Complex string */
$string = "Co'mpl''ex \"st'\"ring";
print "Unquoted string: $string\n";
print "Quoted string: " . $conn->quote($string) . "\n";
?>
|
The above example will output: Unquoted string: Co'mpl''ex "st'"ring
Quoted string: 'Co''mpl''''ex "st''"ring' |
|
See Also
| PDO::prepare() |
| PDOStatement::execute() |