Php mysql_real_escape_string equivalent

Question

I need some dynamic SQL to put a large number of values ​​into the database.

INSERT INTO table1 (a,b,c,d) VALUES (1,2,3,'string with possible quotes'),.... 

Since I want to insert about 1000 lines into a package, parameters are not really an option.
In php, I would use mysql_ lib and mysql_real_escape_string to prevent errors and SQL injections.

How to avoid string values ​​in Delphi?

Answer 1

I once wrote an equivalent delphi function, following the MySql documentation on mysql_real_escape_string .

The from from string is encoded in the escaped SQL string, taking into account the current character set of the connection. As a result, the byte is added and ends. Characters are encoded with "\", "," "," NUL "(ASCII 0)," \ n "," \ r "and Control + Z. Strictly speaking, MySQL only requires a backslash and quote character, used to quote a string in the query, must be escaped. mysql_real_escape_string () quotes other characters to make them easier to read in the log files

obviously, the ..taking into account the current character set of the connection is ignored here.

 function StringReplaceExt(const S : string; OldPattern, NewPattern: array of string; Flags: TReplaceFlags):string; var i : integer; begin Assert(Length(OldPattern)=(Length(NewPattern))); Result:=S; for i:= Low(OldPattern) to High(OldPattern) do Result:=StringReplace(Result,OldPattern[i], NewPattern[i], Flags); end; function mysql_real_escape_string(const unescaped_string : string ) : string; begin Result:=StringReplaceExt(unescaped_string, ['\', #39, #34, #0, #10, #13, #26], ['\\','\'#39,'\'#34,'\0','\n','\r','\Z'] , [rfReplaceAll] ); end;