[Reprinted] PDO anti-injection Principle Analysis and precautions for using PDO, pdo precautions

[Reprinted] PDO anti-injection Principle Analysis and precautions for using PDO, pdo precautions

All content in this article is reposted from the blog http://zhangxugg-163-com.iteye.com/blog/1835721366bc2346092. thank you for sharing this article.

The rational and correct use of PDO can basically prevent SQL injection. This article mainly answers the following two questions:

A. Why use PDO instead of mysql_connect?
B. Why does PDO defend against injection?
C. What should I pay special attention to when using PDO anti-injection?

1. Why is PDO preferred?

Improves query performance for the same SQL Template
Blocking SQL Injection

Ii. Why does PDO defend against SQL injection?

To thoroughly understand the details of the communication between php and mysql server, the author used wireshark packet capture for research.
3. Precautions for using PDO
1. If php 5.3.6 + is used, specify the charset attribute in the DSN of PDO.
What is the role of charset specified in DSN? It only tells PDO that the specified character set (not the mysql server communication Character set) is used for escape of the local driver, and the set names <charset> command must be used to set the mysql server communication character set.
2. If PHP 5.3.6 and earlier versions are used, set the PDO: ATTR_EMULATE_PREPARES parameter to false (that is, the MySQL performs Variable Processing). Because the Yii framework does not set the ATTR_EMULATE_PREPARES value by default, set emulatePrepare to false in the database configuration file.

PHP pre-processes PDO to prevent Injection
Pdo can be used for preprocessing to effectively prevent SQL injection to bgim.

Pdo problems in php
This is a bit too big, and security is not just about SQL!
Using PDO also prevents SQL injection. You need to check your user input !!!! Image single quotes
Php can also be used in several ways! I can't tell you all about it. Let's take a look at the materials. This is usually mentioned in the tutorials!