Ask, why is it that MySQL preprocessing can prevent SQL injection???
Like what:
PHP Code
$link = new mysqli (' localhost ', ' root ', ' 111111 ', ' test '); $link-Set_charset (' UTF8 '); $sql = ' SELECT * from Test WHERE id=? and name=? '; $stmt = $link-Prepare ($sql); $stmt-Bind_param (' is ', $id, $name); $stmt, execute ();
For the above example, my understanding is:
MySQL has already killed the SQL statement "?" before it actually executes. The type value that the number represents.
So, if you give the ID at the location of the "? "Passes a string value, it also turns into an integer, which prevents SQL injection.
However, the name of the "? ", the string should have been passed, and if it was passed to a SQL injected statement, how can you prevent SQL injection?"
Do not know my understanding is right, please advise! Thank you!!
------Solution--------------------
Addslashes ()
------Solution--------------------
The implementation of the prepare preprocessing is essentially an internal escape process, escaping some characters that need to be escaped, and you can't see it, just as you encapsulate an escape method similar, if it is executed directly without preprocessing, there is no escaping this step, thus increasing the risk factor
------Solution--------------------
discuss
Reference:
The implementation of the prepare preprocessing is essentially an internal escape process, escaping some characters that need to be escaped, and you can't see it, just as you encapsulate an escape method similar, if it is executed directly without preprocessing, there is no escaping this step, thus increasing the risk factor
Is it like upstairs yes with a addslashes (), or mysql_escape_string ()?
------Solution--------------------
Develop the habit, do not understand the question asked Php.net, really can not find again to ask the forum.
The conclusion is that you do not need to addslashes, your SQL statement, or "surrounded, prepare automatic addlashes ()."
------Solution--------------------
$v = (Is_int ($v)? $v: "'". Pg_escape_string ($v). "'";
LZ and I use the same is used? Placeholder mode.
？ corresponding to the value one by one, before the query is replaced, this time the shape of the Is_int, the string is used Pg_escape_string ()
Pg_escape_string () escapes a string of Text/char data type, returning the escaped string. It is recommended that you replace addslashes () with this function. (I use the Pgsql database) to escape.
$real _sql. = Preg_replace ('/\?/', $v, $sql _arr[$key],1); This is? The replacement.
------Solution--------------------
Mysql_escape_string Use this to accept the user or write their own users of the value of the user is basically to prevent SQL injection
