Using MySQL PDO to prevent SQL injection

Skills:

1. PHP upgrade to 5.3.6+, production environment is highly recommended to upgrade to PHP 5.3.9+ PHP 5.4+,php 5.3.8 There is a fatal hash collision vulnerability.

2. If you are using PHP 5.3.6+, specify the charset attribute in the PDO DSN
3. If PHP 5.3.6 and previous versions are used, set the Pdo::attr_emulate_prepares parameter to False (that is, the variable is handled by MySQL), PHP 5.3.6 or later has already dealt with this issue, Whether you are using a local emulation prepare or a prepare that calls MySQL server. Specifying CharSet in DSN is not valid, and the execution of set names <charset> is essential.

4. If PHP 5.3.6 and previous versions are used, because the YII framework does not set the value of Attr_emulate_prepares by default, specify the value of Emulateprepare in the database configuration file as false.

So, if you specify CharSet in DSN, do you still need to perform set names <charset>?
Yes, it can't be saved. Set names <charset> actually has two functions:
A. Tell MySQL server what the encoding is for the client (PHP program) to submit to it
B. Tell MySQL server what is the encoding of the results required by the client
In other words, if the data table uses the GBK character set, and the PHP program uses UTF-8 encoding, we run the set names UTF8 before executing the query, telling MySQL server to encode correctly, without having to encode the conversion in the program. This way we submit the query to MySQL server with Utf-8 encoding, and the result will be UTF-8 encoding. Eliminates the conversion coding problem in the program, do not have the doubt, this does not produce garbled.

What is the role of specifying CharSet in DSN? Just tell PDO that the local drive escapes using the specified character set (not setting the MySQL server communication character set), setting the MySQL server communication character set, and using the set names <charset> directive.

Reprint website: http://www.jb51.net/article/56612.htm

Using MySQL PDO to prevent SQL injection