Common prevention methods for mysql injection by php

Now I will summarize the following main types of code: for integer data, use intval to forcibly convert mysql to prevent injection before insertion. Generally, it is to submit (post or get) pages) the following two types of data are received: one is the php logic module. To escape special characters submitted on the page, use get_magic_quotes_gpc () to check whether automatic escape settings are enabled. If this setting is not enabled, you can use the addslashes () function to add a backslash to the database query statement and so on. For example:

If (! Get_magic_quotes_gpc () {foreach ($ _ POST as $ _ key =>$ _ value) {if (! Is_array ($ _ value) $ _ POST [$ _ key] = addslashes ($ _ value );}}

 

The second is the mysql processing module. Using the mysql_real_escape_string () function of mysql, you can escape special characters and characters that may cause database operation errors. For example:

If (get_magic_quotes_gpc () {$ str = stripslashes ($ str);} else {$ str = mysql_real_escape_string ($ str );}