escaping strings for SQLite3 in PHP5

问题:

Why does both functions fail me? Or is this just an illusion?

<?php
echo sqlite_escape_string('Hello "World" \'\' ...');
echo "\n";
echo SQLite3::escapeString('Hello "World" \'\' ...');
echo "\n";
?>

outputs:

Hello "World" '''' ...
Hello "World" '''' ...

回答1:

You should be using PDO to access your database because it has prepared statements which are safer than escaping and also faster.

The PHP Data Objects (PDO) extension defines a lightweight, consistent interface for accessing databases in PHP. Each database driver that implements the PDO interface can expose database-specific features as regular extension functions.

Another big adventage when using PDO is that you can switch between databases(MySQL vs PostGRESQL vs SQLite for example) easily without changing much of your code.

A quick introduction how to use PDO can be read over at nettuts. A very good read/introduction if you ask me!