Solve SQLinjection using PHP functions

The use of PHP functions to solve SQLinjection SQL injection problems has become a hot topic in ASP. of course, there are still many well-known PHP programs at home and abroad "killed ". As for SQL injection details, there are too many articles on the Internet, so I will not introduce them here.
If the php. if magic_quotes_gpc in The INI file is set to off, PHP will not add a backslash () before sensitive characters. because the content submitted by the form may contain sensitive characters, such as single quotes ('), this causes the SQL injection vulnerability. In this case, we can use addslashes () to solve the problem. it will automatically add a backslash before sensitive characters.
However, the above method only applies when magic_quotes_gpc is Off. As a developer, you don't know whether magic_quotes_gpc of every user is On or Off. if you use addslashes () for all the data, isn't it "killing innocent? If magic_quotes_gpc = On and the addslashes () function is used, let's take a look:

The code is as follows:

// If you submit a variable $ _ POST ['message'] from the form, the content is Tom's book
// Add the code to connect to the MySQL database. write it by yourself.
// Add a backslash before the sensitive character $ _ POST ['message ']
$ _ POST ['message'] = addslashes ($ _ POST ['message']);

// Because magic_quotes_gpc = On, a backslash is added before sensitive characters.
$ SQL = "INSERT INTO msg_table VALUE ('$ _ POST [message]');";

// Send a request to save the content to the database
$ Query = mysql_query ($ SQL );

// If you extract this record from the database and output it, you will see Tom \'s book
?>

In this case, in the magic_quotes_gpc = On environment, all input single quotes (') will become (\')......
In fact, we can use the get_magic_quotes_gpc () function to easily solve this problem. When magic_quotes_gpc = On, this function returns TRUE; when magic_quotes_gpc = Off, FALSE is returned. So far, many people have realized that the problem has been solved. See the code:

The code is as follows:

// If magic_quotes_gpc = Off, add a backslash to the sensitive characters in the $ _ POST ['message'] submitted by the ticket.
// If magic_quotes_gpc = On, no
If (! Get_magic_quotes_gpc ()){
$ _ POST ['message'] = addslashes ($ _ POST ['message']);
} Else {}
?>

In fact, the problem has been solved. Next, let's talk about some tips.
Sometimes there are more than one variable to be submitted in a form. There may be a dozen or dozens of variables. Is it a little trouble to copy/paste the addslashes () at a time? Because the data obtained from the form or URL is in the form of an array, such as $ _ POST, $ _ GET), you can customize a function that can "scan the Army:

The code is as follows:

Function quotes ($ content)
{
// If magic_quotes_gpc = Off, start processing
If (! Get_magic_quotes_gpc ()){
// Determine whether $ content is an array
If (is_array ($ content )){
// If $ content is an array, it will process every single
Foreach ($ content as $ key => $ value ){
$ Content [$ key] = addslashes ($ value );
}
} Else {
// If $ content is not an array, it will be processed only once.
Addslashes ($ content );
}
} Else {
// If magic_quotes_gpc = On, it will not be processed
}
// Returns $ content
Return $ content;
}
?>

This should be a problem, because the elements of the array in $ _ GET are also possible.
It is an array, so we still need to call it recursively. this vbb has a function. php in this
Functions are fully used.

The code is as follows:

Function quotes ($ content ){
If (! Get_magic_quotes_gpc ()){
If (is_array ($ content )){
Foreach ($ content as $ key => $ value ){
$ Content [$ key] = quotes ($ value );
}
} Else {
Addslashes ($ content );
}
}
Return $ content;
}

Function unquotes ($ content ){
If (get_magic_quotes_gpc ()){
If (is_array ($ content )){
Foreach ($ content as $ key => $ value ){
$ Content [$ key] = unquotes ($ value );
}
} Else {
Stripslashes ($ content );
}
}
Return $ content;
}