Prevents SQL injection and SQL Injection

Prevents SQL injection and SQL Injection

1 function checkStr ($ username) {2 // custom string rule 3} 4 5 function checkLogin ($ username, $ password) {6 7 $ password = md5 ($ password ); 8 9 $ username = addslashes ($ username); // escape 10 11 $ SQL = "select * from {$ this-> getTableName ()} where u_username = '{$ username}' and u_password = '{$ password}' "; 12 13 return $ this-> db_getRow ($ SQL); 14}

In two steps, first define the character string rules, such as removing special characters with spaces, and then use escape characters. The subsequent statements must be enclosed in single quotation marks.