Using PHP functions to solve SQL injection_php tutorial

SQL injection problem on the ASP but there are also many famous PHP programs at home and abroad, "killed." As for the details of SQL injection, there are so many articles on the Internet that we don't introduce them here.
If the MAGIC_QUOTES_GPC in your php.ini file in your Web space is set to OFF, then PHP will not precede the sensitive character with a backslash (\), because the content submitted by the form may contain sensitive characters, such as single quotation marks ('), resulting in a vulnerability to SQL injection. In this case, we can use Addslashes () to solve the problem, which automatically adds a backslash before the sensitive character.
However, the above method only applies to magic_quotes_gpc=off cases. As a developer, you don't know if each user's MAGIC_QUOTES_GPC is on or off, and if all of the data is addslashes (), isn't that "killing innocents"? If Magic_quotes_gpc=on, and the Addslashes () function is used again, let's take a look at: If a variable $_post[' message ' is submitted from the form, the content is Tom's book
This adds the code to connect to the MySQL database, write it Yourself
Precede the sensitive character of $_post[' message ' with a backslash
$_post[' message ' = addslashes ($_post[' message ');

Because of the magic_quotes_gpc=on, the backslash is added again before the sensitive character
$sql = "INSERT into msg_table VALUE (' $_post[message] ');";

Send the request to save the content in the database
$query = mysql_query ($sql);

If you extract this record from the database and output it, you will see Tom\ 's book
?>

In this case, in the Magic_quotes_gpc=on environment, all the input single quotes (') will become (\ ') ...
In fact, we can use the GET_MAGIC_QUOTES_GPC () function to solve this problem easily. The function returns True when Magic_quotes_gpc=on, and returns False when Magic_quotes_gpc=off. At this point, there must have been a lot of people realize: the problem has been solved. Please look at the code: If Magic_quotes_gpc=off, then the sensitive word multibyte backslash in $_post[' message ' submitted for Bill of lading
Magic_quotes_gpc=on, the case is not added
if (!GET_MAGIC_QUOTES_GPC ()) {
$_post[' message ' = addslashes ($_post[' message ');
} else {}
?>
Actually speaking here, the problem has been solved. Here's a little trick.
Sometimes a form submits more than one variable, and there can be more than 10 or dozens of of these. Copy/Paste the addslashes () once and again, is it a bit of a hassle? Since the data obtained from the form or URL is in the form of an array, such as $_post, $_get, then customize a function that can "annihilation": function quotes ($content)
{
If Magic_quotes_gpc=off, then start processing
if (!GET_MAGIC_QUOTES_GPC ()) {
Determine if the $content is an array
if (Is_array ($content)) {
If $content is an array, then it is processed by every single
foreach ($content as $key = = $value) {
$content [$key] = addslashes ($value);
}
} else {
If $content is not an array, it is processed only once
Addslashes ($content);
}
} else {
If magic_quotes_gpc=on, then do not deal with
}
Back to $content
return $content;
}
?>

http://www.bkjia.com/PHPjc/314550.html www.bkjia.com true http://www.bkjia.com/PHPjc/314550.html techarticle SQL injection problem on the ASP but there are also many famous PHP programs at home and abroad, "killed." As for the details of SQL injection, there are too many articles on the Internet.

