Summary and Analysis of PHP anti-SQL injection methods _ PHP Tutorial

Summary and Analysis of PHP anti-SQL injection methods. In program development, SQL injection is a problem that everyone will often consider. I will analyze the common SQL anti-injection code below. if you need it, refer to it. 1. SQL injection is a problem that everyone will often consider when submitting php Data in program development. next I will resolve the common SQL anti-injection code. if you need it, please refer to it.

1. basic principles of php Data Submission and filtering

1) when submitting variables to the database, we must use addslashes () for filtering. for example, we can solve an addslashes () problem. In fact, when variable values are involved, the intval () function is also a good choice for string filtering.

2) enable magic_quotes_gpc and magic_quotes_runtime in php. ini. Magic_quotes_gpc can change the quotation marks in get, post, and cookie to a slash. Magic_quotes_runtime can be used as a format for inbound and outbound data. In fact, this parameter is very popular as early as the previous injection was crazy.

The code is as follows:
If (isset ($ _ POST ["f_login"]) { // Connect to the database... //... Code omitted... // Check whether the user exists $ T_strUname = $ _ POST ["f_uname"]; $ T_strPwd = $ _ POST ["f_pwd"]; $ T_strSQL = "SELECT * FROM tbl_users WHERE username = '$ t_strUname' AND password = '$ t_strPwd' LIMIT "; If ($ t_hRes = mysql_query ($ t_strSQL )) { // Processing after successful query... } } ?> Sample test

3) when using system functions, you must use the escapeshellarg () and escapeshellcmd () parameters to filter them out, so that you can safely use the system functions.

4) for cross-site, strip_tags () and htmlspecialchars () parameters are both good, and user-submitted tags with html and php will be converted. For example, the angle brackets "<" are converted to harmless characters such as "<.

The code is as follows:
$ New = htmlspecialchars ("Test", ENT_QUOTES ); Strip_tags ($ text ,);

5) filter related functions, such as the previous include (), unlink, and fopen () functions. as long as you specify the variables for the operation you want to perform or strictly filter the relevant characters, I think this will be impeccable.

2. simple PHP Data Filtering

1) warehouse receiving: trim ($ str), addslashes ($ str)
2) Outbound: stripslashes ($ str)
3) Display: htmlspecialchars (nl2br ($ str ))

I. injection attack types

There may be many different types of attack motives, but at first glance, there seems to be more types. This is true-if a malicious user finds a way to execute multiple queries. We will discuss this in detail later in this article.
For example
If your script is executing a SELECT command, attackers can force each row of records in a table to be displayed. by injecting a condition such as "1 = 1" into the WHERE clause, as shown below (the injection part is shown in bold):

The code is as follows:
SELECT * FROM wines WHERE variety = 'lagrein' OR 1 = 1 ;'

As we have discussed earlier, this may be useful because it reveals the general structure of the table (which is not implemented by a common record ), and potentially displaying records containing confidential information.
An update command may pose a more direct threat. By placing other attributes in the SET clause, an attacker can modify any field in the currently updated record, for example, in the following example (the injection part is shown in bold ):

The code is as follows:
UPDATE wines SET type = 'red', 'vintage' = '000000' WHERE variety = 'lagrein'

By adding a constant condition such as 1 = 1 to the WHERE clause of an update command, the modification range can be extended to each record, for example, the following example (WHERE, the injection part is shown in bold ):

The code is as follows:
UPDATE wines SET type = 'red', 'vintage' = '2014 WHERE variety = 'lagrein' OR 1 = 1 ;'

The most dangerous command may be DELETE-which is not hard to imagine. Its injection technology is the same as what we have seen-by modifying the WHERE clause to extend the range of affected records, for example, the following example (the injection section is shown in bold ):

The code is as follows:
Delete from wines WHERE variety = 'lagrein' OR 1 = 1 ;'

2. multiple query injections
Multiple query injections can aggravate the potential damage that an attacker may cause-by allowing multiple destructive commands to be included in a single query. When using the MySQL database, attackers can easily achieve this by inserting an unexpected Terminator into the query-an injected quotation mark (single or double quotation marks) at this time) mark the end of the expected variable, and use a semicolon to terminate the command. Now, another attack command may be added to the end of the currently terminated original command. The final destructive query may look as follows:
The code is as follows:

The code is as follows:
SELECT * FROM wines WHERE variety = 'lagrein '; Grant all on *. * TO 'badguy @ % 'identified by 'gotcha ';'

This injection creates a new user, BadGuy, and grants it Network privileges (with all privileges on all tables, another "ominous" password is added to this simple SELECT statement. If you follow our advice in previous articles-strictly restrict the privileges of users in this process, this should not work because the web server daemon no longer has the permissions you withdraw. However, theoretically, such an attack may give BadGuy the freedom to perform any operations on your database.

Below is a self-written

The code is as follows:

Function phpsql_show ($ str ){ $ Str = stripslashes ($ str ); $ Str = str_replace ("\", "", $ str ); $ Str = str_replace ("/", "/", $ str ); $ Str = str_replace ("", "", $ str ); $ Str = str_replace (",", $ str ); Return $ str; } Function phpsql_post ($ str ){ $ Str = stripslashes ($ str ); $ Str = str_replace ("|", "|", $ str ); $ Str = str_replace ("<", "<", $ str ); $ Str = str_replace (">", ">", $ str ); $ Str = str_replace ("", "", $ str ); $ Str = str_replace ("", "", $ str ); $ Str = str_replace ("(", "(", $ str ); $ Str = str_replace (")", ")", $ str ); $ Str = str_replace ("" ', "'", $ str ); // $ Str = str_replace ("'", "'", $ str ); $ Str = str_replace ('"'," ", $ str ); $ Str = str_replace (",", $ str ); $ Str = str_replace ("$", "$", $ str ); $ Str = str_replace ("", "\", $ str ); $ Str = str_replace ("/", "/", $ str ); Return $ str; } Function phpsql_replace ($ str ){ $ Str = stripslashes ($ str ); $ Str = str_replace ("'", "'", $ str ); Return $ str; }

Summary:

* Addslashes () is forcibly added;
* Mysql_real_escape_string () determines the character set, but it is required for the PHP version;
* Mysql_escape_string does not consider the connected current character set.

In dz, the function addslashes is used to prevent SQL injection, in the dthmlspecialchars function, replace $ string = preg_replace (/& (# (d {3, 5} | x [a-fA-F0-9] {4 }));)/, & 1. this replacement solves the injection problem and Chinese garbled characters.

Bytes. 1. submit data in php...