我进行了此插入查询:
$insertsuccess = $wpdb->insert(
\'compservices\',
array(
\'orderId\'=> $orderID,
\'orderedTime\' => $date,
\'useremail\' => $customerEmail,
\'address\' => $address ,
\'mobile\' => $mobile ,
\'servicecenter\' => $servicecentername ,
\'timeslot\'=> $timeSlot,
\'preferredlanguage\'=> $preferredLanguage,
\'status\'=> $orderStatus,
\'completedDate\'=> $orderCompletionDate,
\'userissue\'=> $userIssue ,
\'userproduct\'=> $userProduct
),
array(
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\',
\'%s\'
)
);
var_dump( $wpdb->last_query );
//echo $wpdb->insert_id;
//$wpdb->print_error();
if($insertsuccess) {
return true;
} else {
return false;
}
wpdb->last\\u查询的输出为:
string(423) "INSERT INTO `compservices` (`orderId`, `orderedTime`, `useremail`, `address`, `mobile`, `servicecenter`, `timeslot`, `preferredlanguage`, `status`, `completedDate`, `userissue`, `userproduct`) VALUES (\'GV2016021757\', \'2016-02-17 23:20\', \'[email protected]\', \'jnerjnmejnrerr\', \'9999999999\', \'GVONE\', \'2016-02-18 - 09 AM to 12 PM\', \'ENG\', \'Ordered\', NULL, \'\', \'kdnsjknjer\')"
实际查询为
string(423) "INSERT INTO `compservices` (`orderId`, `orderedTime`, `useremail`, `address`, `mobile`, `servicecenter`, `timeslot`, `preferredlanguage`, `status`, `completedDate`, `userissue`, `userproduct`) VALUES (\'GV2016021757\', \'2016-02-17 23:20\', \'[email protected]\', \'jnerjnmejnrerr\', \'9999999999\', \'GVONE\', \'2016-02-18 - 09 AM to 12 PM\', \'ENG\', \'Ordered\', NULL, \'<script>alert("hello")</script>\', \'kdnsjknjer\')"
插入的数据为
所有相同的数据以及脚本标记也存在:
<script>alert(\\\'hello\\\')</script>
预期wpdb->插入将清理脚本标记并将其删除。它在wpdb->last\\u查询中显示正确。但数据库中的数据有脚本标记。
我不知道为什么会这样。