Forthose curious, the exact escaping performed on the string may vary slightly depending on your database configuration.
For example, if your database's standard_conforming_strings variable is OFF, backslashes are treated as a special character and pg_escape_string() will ensure they are properly escaped. If this variable is ON, backslashes will be treated as ordinary characters, and pg_escape_string() will leave them as-is. In either case, the behavior matches the configuration of the database connection.
PHP - Manual: pg_escape_string
2024-11-15
pg_escape_string
(PHP 4 >= 4.2.0, PHP 5, PHP 7, PHP 8)
pg_escape_string — 转义 text/char 类型的字符串
说明
pg_escape_string(string
$data): stringpg_escape_string() 转义 text/char 数据类型的字符串，返回转义后的字符串。建议用此函数替代 addslashes()。
注意:
本函数需要 PostgreSQL 7.2 或以上版本。
add a note
User Contributed Notes 11 notes
strata_ranger at hotmail dot com ¶
11 years ago
Nathan Bruer ¶
14 years ago
If your database is a UTF-8 database, you will run into problems trying to add some data into your database...
for securty issues and/or compatability you may need to use the: utf_encode() (http://php.net/utf8-encode) function.
for example:
<?php
$my_data = pg_escape_string(utf8_encode($_POST['my_data']));
?>
ringerc at ringerc dot id dot au ¶
8 years ago
You should prefer to use pg_query_params, i.e. use parameterized queries, rather than using pg_escape_string. Or use the newer PDO interface with its parameterized query support.
If you must substitute values directly, e.g. in DDL commands that don't support execution as parameterized queries, do so with pg_escape_literal:
http://au1.php.net/manual/en/function.pg-escape-literal.php
Identifiers can't be used as query parameters. Always use pg_escape_identifier for these if they're substituted dynamically:
http://au1.php.net/manual/en/function.pg-escape-identifier.php
You should not need to change text encodings when using this function. Make sure your connection's client_encoding is set to the text encoding used by PHP, and the PostgreSQL client driver will take care of text encodings for you. No explicit utf-8 conversions should be necessary with a correctly set client_encoding.
ppp ¶
10 years ago
pg_escape_string() won't cast array arguments to the "Array" string like php usually does; it returns NULL instead. The following statements all evaluate to true:
<?php
$a = array('foo', 'bar');
"$a" == 'Array';
(string)$a == 'Array';
$a . '' == 'Array';
is_null(pg_escape_string($a));
?>
johniskew2 at yahoo dot com ¶
16 years ago
For those who escape their single quotes with a backslash (ie \') instead of two single quotes in a row (ie '') there has recently been a SERIOUS sql injection vulnerability that can be employed taking advantage of your chosen escaping method. More info here: http://www.postgresql.org/docs/techdocs.50
Even after the postgre update, you may still be limited to what you can do with your queries if you still insist on backslash escaping. It's a lesson to always use the PHP functions to do proper escaping instead of adhoc addslashes or magic quotes escaping.
meng ¶
16 years ago
Since php 5.1 the new function pg_query_params() was introduced. With this function you can use bind variables and don't have to escape strings. If you can use it, do so. If unsure why, check the changelog for Postgres 8.0.8.
otix ¶
16 years ago
Creating a double-tick is just fine. It works the same as the backslash-tick syntax. From the PostgreSQL docs:
The fact that string constants are bound by single quotes presents an obvious semantic problem, however, in that if the sequence itself contains a single quote, the literal bounds of the constant are made ambiguous. To escape (make literal) a single quote within the string, you may type two adjacent single quotes. The parser will interpret the two adjacent single quotes within the string constant as a single, literal single quote. PostgreSQL will also allow single quotes to be embedded by using a C-style backslash.
efjiolvwejlojfwel at mailinator dot com ¶
4 years ago
Please, as a service to the Internet, add a note advising developers to use prepared statements and placeholders, and deprecate this function and its friends (but not pg_escape_identifier).
There is no valid reason to mix data and SQL into a single string before sending it to the RDBMS, and thus create the potential for SQL injection vulnerabilities. Hence, there is no need to escape data. Hence, there is no need for this function. It's confusing to offer developers functionality that they don't need and shouldn't use.
Gautam Khanna ¶
14 years ago
Security methods which you use depend on the specific purpose. For those who dont know, take a look at the following built-in PHP functions:
strip_tags() to remove HTML characters
(also see htmlspecialchars)
escapeshellarg() to escape shell commands etc
escapeshellcmd()
mysql_real_escape_string() to escape mySQL commands.
Enjoy!
web dot expert dot panel at gmail dot com
strata_ranger at hotmail dot com ¶
10 years ago
This may seem obvious, but remember that pg_escape_string escapes values for use as string literals in an SQL query -- if you need to escape arbitrary strings for use as SQL identifiers (column names, etc.), there doesn't seem to be a PHP function for that so you'll have to do that escaping yourself. (PostgreSQL has an in-database function, quote_ident(), that does this.)
This can be an issue if your database contains mixed-case (or otherwise unusual) column names and you have a class interface managing your database/query interactions (for connecting to different types of databases). If you don't double-quote your column names then postgreSQL will match them case-insensitively, but will label the results in all-lowercase (which differs from MySQL).
For example:
<?php
// Plain column identifier
$res = pg_query("Select columnName from table");
$row = pg_fetch_assoc($res);
var_dump($row['columnName']); // Doesn't work (throws E_NOTICE)
var_dump($row['columnname']); // Works
// Escaped column identifier
$res = pg_query("Select \"columnName\" from table");
$row = pg_fetch_assoc($res);
var_dump($row['columnName']); // Works
var_dump($row['columnname']); // Doesn't
?>
arunintellirise at gmail dot com ¶
4 years ago
PostgreSQL is a powerful and an open source object relational database having more than 15 years of active development and a proven architecture with an emphasis on extensibility and standards compliance. PostgreSQL primary functions are to store data securely and return that data in response to requests from other software applications that has earned it a strong reputation for reliability, data integrity and correctness which runs on all major operating system including Linux, UNIX and Windows. PostgreSQL is a cross platform which is open source and its source code is available free of charge that is not controlled by any corporation or other private entity. PostgreSQL also supports storage of binary large objects including picture, sound or video along with handles workloads ranging from small single machine applications to large internet facing applications with lots of concurrent users. PostgreSQL is highly scalable in the sheer quantity of data which support international character sets and multibyte character encodings.
if you know more aboutthis note then please visit on our website.
https://www.codesroom.com/blog/postgresql
官方地址：https://www.php.net/manual/en/function.pg-escape-string.php
IT
PHP
编程语言
Linux
开发编程
科技
Elasticsearch
HTML/CSS/XML
网络
JAVA
NoSQL
数据库
面试
C/C++
Golang
Git
算法
操作系统
正则表达式
Redis
互联网
MySql
JavaScript
运维
软件
国际
架构设计
Mac OS
TCP/IP
Excel
Vim
Windows
Socket
Oracle
VR
MongoDB
Python
运营
MemCache
商业
硬件
电子
娱乐
设计
nginx
摄影
游戏
WordPress
HTTP
团建
数码电器
广告
--
php7 安装fileinfo扩展
preg_split — 通过一个正则表达式分隔字符串
php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题
[PHP] inet_pton/inet_ntop IP地址转换函数
array_multisort() 多字段排序
PHPMailer设置utf8 PHPMailer字符集CharSet
ADORecordSet对象
adodb手册
PHP 8.1
[鸟哥]PHP_INT_MIN 和 -9223372036854775808
opcache预加载
Composer的Packagist资源
mysql面试题
[鸟哥]PHP FFI详解 - 一种全新的PHP扩展方式
PHP7添加redis扩展
Packagist / Composer 中国全量镜像
PHP获取指定函数定义在哪个文件中及行号
PHP mkdir()写出来的权限与mode值不符合
adodb连接mysql多个数据库的问题
常用的php ADODB使用方法集锦