mysqli_real_escape_string()期望参数1为mysqli，布尔给定集

Question

我得到了很多错误，比如: mysqli_real_escape_string()期望参数1是mysqli，布尔给定

错误是，mysqli_real_escape_string()需要2个参数，但只有一个项需要更新。

问题是：

$updatequery = "
    UPDATE
        as_comprofiler
    SET
        cb_empstatustime = '".time()."'
        , cb_profiel = '".mysqli_real_escape_string($value->profile->nickname)."'
        , cb_empstatus = '".mysqli_real_escape_string($cb_empstatus)."'
        , cb_taal = '".mysqli_real_escape_string($talen)."'
        , cb_sms = '".mysqli_real_escape_string($sms)."'
    WHERE
        cb_boxnr = '".mysqli_real_escape_string($value->boxnumber)."'
    "; 

这一页的完整部分：

// elke ***
foreach ($xml->consultant as $value) {

    // $cb_empstatus vullen a.d.h.v activated en callstatus
    if ($value->activated == 0) {
        $cb_empstatus = 'Afwezig';
    } elseif ($value->activated == 1) {
        if ($value->callstatus == 0) {
            $cb_empstatus = 'Beschikbaar';
        } elseif ($value->callstatus == 1) {
            $cb_empstatus = 'Bezet';
        } elseif ($value->callstatus == 2) {
            $cb_empstatus = 'Pauze';
        }
    }

    // lege variabele aanmaken
    $talen = '';
    $sep = '';

    foreach ($value->languages->language as $taal) {
        $talen .= $sep;
        $talen .= $taal;
        $sep = '|*|';
    }

    // sms code omzetten naar tekst
    if ($value->smsavailable == 1) {
        $sms = 'Ja';
    } else {
        $sms = 'Nee';
    }

    // de update query
    $updatequery = "
        UPDATE
            as_comprofiler
        SET
            cb_empstatustime = '".time()."'
            , cb_profiel = '".mysqli_real_escape_string($value->profile->nickname)."'
            , cb_empstatus = '".mysqli_real_escape_string($cb_empstatus)."'
            , cb_taal = '".mysqli_real_escape_string($talen)."'
            , cb_sms = '".mysqli_real_escape_string($sms)."'
        WHERE
            cb_boxnr = '".mysqli_real_escape_string($value->boxnumber)."'
        ";

    if (mysqli_query($updatequery) == false) {
        // foutmelding
        echo 'Niet uitgevoerd:<br>'.$updatequery.'<br><br>';
    }

一个主意？

Answer 1

您必须在mysqli连接器函数中添加mysqli_real_escape_string()作为第一个参数。并将要转义的字符串设置为第二个参数。

<?php
// Let's suppose this is your mysqli connector
$mysqli = mysqli_connect("localhost", "user", "password", "database");

// Then your code should looks like this:
$updatequery = "
    UPDATE
        as_comprofiler
    SET
        cb_empstatustime = '".time()."'
        , cb_profiel = '".mysqli_real_escape_string($mysqli, $value->profile->nickname)."'
        , cb_empstatus = '".mysqli_real_escape_string($mysqli, $cb_empstatus)."'
        , cb_taal = '".mysqli_real_escape_string($mysqli, $talen)."'
        , cb_sms = '".mysqli_real_escape_string($mysqli, $sms)."'
    WHERE
        cb_boxnr = '".mysqli_real_escape_string($mysqli, $value->boxnumber)."'
    "; 
?>

字符串的文档准确地说：

mysqli_real_escape_string(mysqli $mysql, string $string): string

这意味着：

1. 第一个参数必须是由连接()或init()返回的一个init()对象。
2. 第二个参数必须是要转义的字符串。