这些mysql_real_escape_string用法是否相同？

Question

他们俩都一样吗？感谢。

$user = $_POST['user'];
$user = mysql_real_escape_string($user);
$result = mysql_fetch_array(mysql_query("SELECT * FROM accounts WHERE id='$user'"));

VS

$user = $_POST['user'];
$result = mysql_fetch_array(mysql_query(sprintf("SELECT * FROM accounts WHERE id='%s'",mysql_real_escape_string($user))));

Answer 1

是的，这是等效的。

您可以这样验证：

$user = $_POST['user'];
$user = mysql_real_escape_string($user);
echo "SELECT * FROM accounts WHERE id='$user'";

-vs -

$user = $_POST['user'];
echo sprintf("SELECT * FROM accounts WHERE id='%s'", mysql_real_escape_string($user));

Answer 2

是的，它们是相同的

http://php.net/manual/en/function.sprintf.php

Answer 3

是的，他们是等同的。通常，您将使用sprintf使代码更易于阅读，并且查询更容易修改：

$user = $_POST['user'];
$sql = sprintf("SELECT * FROM accounts WHERE id='%s'", 
    mysql_real_escape_string($user)
);
$result = mysql_fetch_array(mysql_query($sql));