PHP SQL Prevention injection and attack technology implementation and approach (_php) tutorial

PHP Tutorial SQL Prevention injection and attack technology implementation and approach
1. The MAGIC_QUOTES_GPC option in PHP config file php.ini is not turned on and is set to off

2. The developer does not check and escape the data type

But in fact, the 2nd is the most important. I think that checking the type of data entered by the user and submitting the correct data type to the MySQL tutorial should be the most basic quality of a web programmer. But in reality, many small white web developers often forget this, causing the backdoor to open.

Why is 2nd the most important? Because without the 2nd guarantee, the MAGIC_QUOTES_GPC option, whether on or off, could trigger a SQL injection attack. Here's a look at the technology implementation:

One. MAGIC_QUOTES_GPC = off injection attack
MAGIC_QUOTES_GPC = Off is a very insecure option in PHP. The new version of PHP has changed the default value to ON. However, there are still quite a few options for the server to OFF. After all, the antique servers are also used by people.

When MAGIC_QUOTES_GPC = ON, it will add all the ' (single quotation marks), "(double number), (backslash), and white space characters in the submitted variable to the front automatically. The following is an official description of PHP:

MAGIC_QUOTES_GPC Boolean

Sets the Magic_quotes state for GPC (Get/post/cookie) operations. When Magic_quotes is on, all ' (Single-quote), "(double quote), (backslash) and Nul ' s is escaped with a backslash autom Atically

1 2 3 4

http://www.bkjia.com/PHPjc/629722.html www.bkjia.com true http://www.bkjia.com/PHPjc/629722.html techarticle PHP Tutorial SQL Prevention injection and attack technology implementation and approach 1. The MAGIC_QUOTES_GPC option in PHP config file php.ini is not turned on and is set to OFF 2. The developer does not have a data type in ...

