PHP to prevent SQL injection function introduction

A few days ago the site has been injected, and now I give you to introduce PHP to prevent SQL injection of several of the processing functions, such as PHP addslashes (), mysql_real_escape_string (), the MySQL operation function (), Mysql_escape _string () and other functions

Specific usage: addslashes prevent SQL injection

Although many PHP programmers in the country still rely on addslashes to prevent SQL injection, it is recommended to strengthen Chinese to prevent SQL injection check. The problem with addslashes is that hackers can use 0xbf27 instead of single quotes, and addslashes just modifies 0xbf27 to 0xbf5c27 as a valid multibyte character, where 0xbf5c is still considered a single quote, So addslashes can't intercept successfully.

Of course addslashes is not useless, it is used for single-byte string processing, multibyte characters or mysql_real_escape_string bar.

For an example of GET_MAGIC_QUOTES_GPC in the PHP manual, the code is as follows:

<?php

function Post_check ($post)

{

if (!GET_MAGIC_QUOTES_GPC ())//Determine if MAGIC_QUOTES_GPC is open

{

$post = Addslashes ($post); To filter the submission data without opening the MAGIC_QUOTES_GPC

}

$post = Str_replace ("_", "_", $post); Filter out the ' _ '

$post = str_replace ("%", "%", $post); Filter out the '% '

$post = NL2BR ($post); Carriage return Conversion

$post = Htmlspecialchars ($post); HTML markup Conversions

return $post;

}//Open Source Code phpfensi.com

?>

Or

<?php

function Inject_check ($sql _str)

{

Return eregi (' select|insert|update|delete| ' |

function verify_id ($id =null)

{

if (! $id) {exit (' No arguments are submitted! '); }//Is null-judged

ElseIf (Inject_check ($id)) {exit (' argument submitted is illegal! '); }//Injection judgment

ElseIf (!is_numeric ($id)) {exit (' argument submitted is illegal! '); }//Digital judgment

$id = Intval ($id); The whole type of

return $id;

}

?>

String mysql_real_escape_string (String $unescaped _string [, Resource $link _identifier])

This function escapes the special characters in unescaped_string and counts the current character set of the connection, so it can be used safely for mysql_query ().

Note:mysql_real_escape_string () does not escape% and _.

Mysql_real_escape_string,example#1 mysql_real_escape_string () example, the code is as follows:

<?php

$item = "Zak s and Derick ' s Laptop";

$escaped _item = mysql_real_escape_string ($item);

printf ("Escaped string:%sn", $escaped _item);

?>

The above example will produce the following output:

Escaped String:zak ' s and Derick ' s Laptop

Mysql_escape_string

This function escapes unescaped_string so that it can be used safely for mysql_query ().

Note: mysql_escape_string () does not escape% and _, this function is exactly the same as mysql_real_escape_string () except mysql_real_escape_string () Accepts a connection handle and transfers the string in addition to the current character set. The mysql_escape_string () does not accept the connection parameters, and regardless of the current character set settings.

Example 1. Mysql_escape_string () example, the code is as follows:

<?php

$item = "Zak ' s Laptop";

$escaped _item = mysql_escape_string ($item);

printf ("Escaped string:%sn", $escaped _item);

?>

Output:

Escaped String:zak ' s Laptop

The difference between the 2 functions of mysql_real_escape_string and mysql_escape_string:

Mysql_real_escape_string must be in (PHP 4 >= 4.3.0, PHP 5) in the case to use, or only with mysql_escape_string, the difference is: mysql_real_escape_ String takes into account the current character set of the connection, and mysql_escape_string is not considered.

We can use the judgment to deal with the complex, the code is as follows:

function Cleanuserinput ($dirty) {

if (GET_MAGIC_QUOTES_GPC ()) {

$clean = mysql_real_escape_string (stripslashes ($dirty));

}else{

$clean = mysql_real_escape_string ($dirty);

}

return $clean;

}

Summing up: * Addslashes () is forcibly added; * Mysql_real_escape_string () will determine the character set, but the PHP version is required; * Mysql_escape_string does not consider the current character set of the connection.

