Prevention of SQL injection with PHP

: This article mainly introduces PHP to prevent SQL injection. For more information about PHP tutorials, see.

SQL injection is generally caused by the inaccuracy of the syntax. The problem occurs in SQL statements, and the decisive one is quote ('). As follows:
$ SQL = "delete from table where id = '$ ID '";
Normal submission means to delete a piece of data. if the id is submitted (1 'or 1 #), the SQL statement becomes
Delete from table where id = '1' or 1 #';
In this way, the entire table will be deleted, resulting in irreparable results.
Since the problem occurs on the quote, you only need to escape it (\')

• Php provides two functions

Addslashes ($ str) // We recommend that you use the following to avoid character set problems: mysql_real_escape_string ($ str, $ link)

// Prevent integer data from being enclosed by SQL quotation marks, and force function ($ str) {return "'" to enclose the converted data in quotation marks "'". mysql_real_escape_string ($ str, $ this-> link ). "'";}

'). AddClass ('pre-numbering '). hide (); $ (this ). addClass ('Has-numbering '). parent (). append ($ numbering); for (I = 1; I <= lines; I ++) {$ numbering. append ($ ('

'). Text (I) ;}; $ numbering. fadeIn (1700) ;}) ;}; script

The above introduces the prevention of SQL injection in PHP, including some content, and hope to be helpful to friends who are interested in PHP tutorials.