mysql_real_escape_string 等效于 Golang

Question

我想转义构成数据库查询一部分的值，但我不能使用参数化查询。

Go 是否具有mysql_real_escape_string可用于转义查询值的 PHP 等价物？

Answer 1

我想出了自己的解决方案来自己创建函数。希望它对某人有用。func MysqlRealEscapeString(value string) string {&nbsp; &nbsp; replace := map[string]string{"\\":"\\\\", "'":`\'`, "\\0":"\\\\0", "\n":"\\n", "\r":"\\r", `"`:`\"`, "\x1a":"\\Z"}&nbsp; &nbsp; for b, a := range replace {&nbsp; &nbsp; &nbsp; &nbsp; value = strings.Replace(value, b, a, -1)&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; return value;}1.MysqlRealEscapeString 不对，下面的测试用例会失败func TestEscape(t *testing.T) {&nbsp; &nbsp; mysqlEscapeList := map[string]string{&nbsp; &nbsp; &nbsp; &nbsp; "\\": "\\\\", "'": `\'`, "\\0": "\\\\0", "\n": "\\n", "\r": "\\r", `"`: `\"`, "\x1a": "\\Z"}&nbsp; &nbsp; for old, want := range mysqlEscapeList {&nbsp; &nbsp; &nbsp; &nbsp; testEscape(t, old, want)&nbsp; &nbsp; }&nbsp; &nbsp; testEscape(t, `<p>123</p><div><img width="1080" />`, `<p>123</p><div><img width=\"1080\" />`)}func testEscape(t *testing.T, origin, want string) {&nbsp; &nbsp; escaped := MysqlRealEscapeString(origin)&nbsp; &nbsp; assert.Equal(t, want, escaped)}改用这个func Escape(sql string) string {&nbsp; &nbsp; dest := make([]byte, 0, 2*len(sql))&nbsp; &nbsp; var escape byte&nbsp; &nbsp; for i := 0; i < len(sql); i++ {&nbsp; &nbsp; &nbsp; &nbsp; c := sql[i]&nbsp; &nbsp; &nbsp; &nbsp; escape = 0&nbsp; &nbsp; &nbsp; &nbsp; switch c {&nbsp; &nbsp; &nbsp; &nbsp; case 0: /* Must be escaped for 'mysql' */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = '0'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; case '\n': /* Must be escaped for logs */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = 'n'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; case '\r':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = 'r'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; case '\\':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = '\\'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; case '\'':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = '\''&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; case '"': /* Better safe than sorry */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = '"'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; case '\032': //十进制26,八进制32,十六进制1a, /* This gives problems on Win32 */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; escape = 'Z'&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; if escape != 0 {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dest = append(dest, '\\', escape)&nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dest = append(dest, c)&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; return string(dest)}

Answer 2

改进的答案：func MysqlRealEscapeString(value string) string {&nbsp; &nbsp; var sb strings.Builder&nbsp; &nbsp; for i := 0; i < len(value); i++ {&nbsp; &nbsp; &nbsp; &nbsp; c := value[i]&nbsp; &nbsp; &nbsp; &nbsp; switch c {&nbsp; &nbsp; &nbsp; &nbsp; case '\\', 0, '\n', '\r', '\'', '"':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.WriteByte('\\')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.WriteByte(c)&nbsp; &nbsp; &nbsp; &nbsp; case '\032':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.WriteByte('\\')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.WriteByte('Z')&nbsp; &nbsp; &nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.WriteByte(c)&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; return sb.String()}