0

可能重复：
防止 SQL 注入的最佳方法？

我无法理解如何清理 php 以防止 SQL 注入，并希望有人能向我解释我需要在这里更改什么以使我的代码安全？

<?php
$dbConnection = mysqli_connect('****', '****', '****', 'db');

$query = "INSERT INTO `table` (`1`, `2`, `3`) VALUES ('$_POST[1]', '$_POST[2]', '$_POST[3]')";

if (mysqli_query($dbConnection, $query)) {
echo "Successfully inserted " . mysqli_affected_rows($dbConnection) . " row";
} else {
echo "Error occurred: " . mysqli_error($dbConnection);
}
?>
4

4 回答 4

2

MySQLi 支持prepared statements，这比手动转义要好：

由于您使用的是程序 MySQLi，因此这里有一个示例：

/* create a prepared statement */
if ($stmt = mysqli_prepare($dbConnection, "INSERT INTO `table` (`1`, `2`, `3`) VALUES (?, ?, ?)"))
{

    /* bind parameters for markers */
    mysqli_stmt_bind_param($stmt, "sss", $_POST[1], $_POST[2], $_POST[3]);

    /* execute query */
    if(mysqli_stmt_execute($stmt))
    {
        echo "Successfully inserted " . mysqli_affected_rows($dbConnection) . " row";
    }
    else
    {
        echo "Error occurred: " . mysqli_error($dbConnection);
    }

    /* close statement */
    mysqli_stmt_close($stmt);
}
于 2012-11-29T11:24:48.313 回答
1

为了防止 SQL 注入，您可以使用准备好的语句。为此，您将需要更多mysqli_功能：

有了这些，您可以编写如下内容：

$dbConnection = mysqli_connect('****', '****', '****', 'db');

// prepare the query
$query = mysqli_prepare( $dbConnection, "INSERT INTO `table` (`1`, `2`, `3`) VALUES (?, ?, ?)";

// bind parameters; 2nd parameter is for data-types
mysqli_stmt_bind_param( $query, "sss", $_POST[1], $_POST[2], $_POST[3] );

// execute query
if ( mysqli_stmt_execute($query) ) {
  echo "Successfully inserted " . mysqli_affected_rows($dbConnection) . " row";
} else {
  echo "Error occurred: " . mysqli_error($dbConnection);
}
于 2012-11-29T11:24:15.197 回答
0

如果您想继续使用旧的 mysql_* 函数，请查看http://php.net/manual/en/function.mysql-real-escape-string.php

$datapoint1 = mysql_real_escape_string($_POST[1]);
...
$query = "INSERT INTO `table` (`1`, `2`, `3`) VALUES ('$datapoint1', '$datapoint2', '$datapoint3')";
于 2012-11-29T11:22:19.170 回答
0

您可以使用准备好的语句或mysqli_real_escape_string

于 2012-11-29T11:22:34.620 回答