Is there any simple way to prevent SQL injection once and for all?

Source: Internet
Author: User
Tags sql injection prevention
Is there any simple way to prevent SQL injection once and for all? I searched it just now and it seems complicated.
Let me talk about my thoughts:
First of all, I don't know if MySQL can add single quotation marks for all types of data. I just tried to add single quotation marks around the integer.
If it is true that all types of data can be enclosed in single quotes, a single quotation mark will be added to any data when a MySQL statement is generated, use mysql_escape_string to escape all special characters in the received characters. In this way, the received string is completely "restricted" between single quotes.

However, it seems that the conversion and normal strings in strings similar to the like clause are different once and for all. In addition, if any update in the AMP involves escaping, problems may occur. Are there solutions to these two problems once and for all? Is there any other problem?

Can all types of data in other databases be enclosed in single quotes?


Reply to discussion (solution)

Php and mysql have filter functions, which can give you peace of mind.

Niu has been very enthusiastic about helping others.

I recommend that you use the php framework because the framework has an SQL injection prevention mechanism.
Such as thinkphp and yii

There is no permanent method
Although no attack methods other than SQL attacks have been reported yet, it cannot be said that there will be no new methods
If you can, once and for all, you have to guard against the future (a little sci-fi)

Php once thought it could help you prevent SQL attacks.
Therefore, the limit that only one SQL command can be executed at a time and the magic_quotes_gpc automatic Escape Switch are enabled.
However, as they expected, there are still many php programmers talking about the so-called SQL attacks.
In view of the inability to establish trust relationships, php gave up the support for automatic escape and relaxed the constraints on sending SQL commands.

As a result, the so-called security issues are completely on the programmer's own ....

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.