PHP Protection Database Specific code example _php tutorial

As the database mismanagement leads to data loss, there are no fewer examples of losses for yourself. We're going to talk this timeThe following code shows a sample script that runs the SQL statement. In this case, the SQL statement is a dynamic statement that allows the same attack. The owner of this form may consider the form to be safe because they have qualified the column name as the selection list. However, the code neglects the last habit of form spoofing-the code restricting the option to a drop-down box does not mean that others will not be able to publish a form that contains the required content (including asterisks [*]).

 
 

  
  

  
< HTML > 
  
  

  
< Head > 
  
  

  
< title >  SQL Injection Example   title>  
  
  

  
 Head > 
  
  

  
< Body > 
  
  

  
< form    id="Myfrom"   action="  " 
  
  

  
 Method = "POST" > 
  
  

  
< Div > < input    type="text"   name="Account_number"  
  
  

  
 value ="   php   Echo (isset ($_post[' Account_number '))? 
  
  

  
$_post[' Account_number ']: ');  ?>"  /> 
  
  

  
< Select    name="col"> 
  
  

  
< option    value="account_number"> account number  option>  
  
  

  
< option    value="name">name   option  >  
  
  

  
< option    value="Address">   address  Option>  
  
  

  
 Select > 
  
  

  
< input    type="Submit"   value="Save"    name = "Submit"/>       Div >   
  
  

  
 form > 
  
  

  
 Php 
  
  

  
if ($_post[' submit '] = = ' Save ') {
  
  

  
/* Do the form processing */
  
  

  
 $ Link  =  mysql_connect (' hostname ', ' user ', ' password ') or
  
  

  
Die (' Could not Connect '. Mysql_error ());
  
  

  
mysql_select_db (' Test ', $link);
  
  

  
 
  
  

  
 $ Col = $_post[' col ']; 
  
  

  

  
  

  
 $ Select  =  "SELECT" . $col. "From Account_data WHERE  account_number  ="
  
  

  
. $_post[' Account_number '. ";" ;
  
  

  
Echo '  <p>  '. $select. '  p> '; 
  
  

  

  
  

  
 $ result  =  mysql_query ($select) or Die ('<p>'. Mysql_error (). '  p> '); 
  
  

  

  
  

  
Echo '  <table>  '; 
  
  

  
While ($row  =  mysql_fetch_assoc($result)) {
  
  

  
Echo '  <tr>  '; 
  
  

  
Echo '  <td>  '. $row [$col]. '  td> '; 
  
  

  
Echo '   tr> '; 
  
  

  
}
  
  

  
Echo '   table> '; 
  
  

  

  
  

  
Mysql_close ($link);
  
  

  
}
  
  

  
?> 
  
  

  
 Body > 
  
  

  
 HTML > 
 
 

Therefore, in order to form the PHP protection database habit, avoid using dynamic SQL code whenever possible. If you cannot avoid dynamic SQL code, do not use input directly on the column. The following shows that in addition to using static columns, you can also add a simple validation routine to the account number field to ensure that the input value is not a non-numeric value.

 
 

  
  

  
< HTML > 
  
  

  
< Head > 
  
  

  
< title >  SQL Injection Example   title>  
  
  

  
 Head > 
  
  

  
< Body > 
  
  

  
< form    id="Myfrom"   action="  "  
  
  

  
 Method = "POST" > 
  
  

  
< Div > < input    type="text"   name="Account_number"  
  
  

  
 value ="   php   Echo (isset ($_post[' Account_number '))? 
  
  

  
$_post[' Account_number ']: ');  ?>"   />   <input  type    ="Submit" 
  
  

  
 value = "Save"   name="Submit"    />  Div  >   
  
  

  
 form > 
  
  

  
 Php 
  
  

  
function Isvalidaccountnumber ($number)
  
  

  
{
  
  

  
Return Is_numeric ($number);
  
  

  
}
  
  

  
if ($_post[' submit '] = = ' Save ') {
  
  

  

  
  

  
/* Remember habit #1--validate your data! */
  
  

  
if (Isset ($_post[' Account_number ')) &
  
  

  
Isvalidaccountnumber ($_post[' Account_number ')) {
  
  

  

  
  

  
/* Do the form processing */
  
  

  
 $ Link  =  mysql_connect (' hostname ', ' user ', ' password ') or
  
  

  
Die (' Could not Connect '. Mysql_error ());
  
  

  
mysql_select_db (' Test ', $link);
  
  

  

  
  

  
 $ Select  =  sprintf ("Select Account_number, Name, Address".) 
  
  

  
"from Account_data WHERE Account_number =%s; ",
  
  

  
Mysql_real_escape_string ($_post[' account_number '));
  
  

  
Echo '  <p>  '. $select. '  p> '; 
  
  

  
 $ result  =  mysql_query ($select) or Die ('<p>'. Mysql_error (). '  p> '); 
  
  

  

  
  

  
Echo '  <table>  '; 
  
  

  
While ($row  =  mysql_fetch_assoc($result)) {
  
  

  
Echo '  <tr>  '; 
  
  

  
Echo '  <td>  '. $row [' Account_number ']. '  td> '; 
  
  

  
Echo '  <td>  '. $row [' name ']. '  td> '; 
  
  

  
Echo '  <td>  '. $row [' address ']. '  td> '; 
  
  

  
Echo '   tr> '; 
  
  

  
}
  
  

  
Echo '   table> '; 
  
  

  

  
  

  
Mysql_close ($link);
  
  

  
} else {
  
  

  
echo "  <span    style= "font-color:red">". 
  
  

  
"supply a valid account number!   span> "; 
  
  

  

  
  

  
}
  
  

  
}
  
  

  
?> 
  
  

  
 Body > 
  
  

  
 HTML > 
 
 

The use of the mysql_real_escape_string () function is also shown in this example of the PHP protection database. This function will correctly filter your input, so it does not include invalid characters. If you have been relying on MAGIC_QUOTES_GPC, be aware that it has been deprecated and will be removed in PHP V6. You should avoid using it from now on and write a secure PHP application in this case. In addition, if you are using an ISP, it is possible that your ISP does not have MAGIC_QUOTES_GPC enabled.

Finally, in the improved PHP protection database example, you can see that the SQL statement and output do not include dynamic column options. Using this method, you can output columns if you add them to a table that later contains different information. If you want to use a framework to work with a database, your framework might have performed SQL validation for you. Ensure that the document is consulted to ensure the security of the framework, and if you are still unsure, verify to ensure that it is secure. Even if you use the framework for database interaction, you still need to perform additional validation.

http://www.bkjia.com/PHPjc/446396.html www.bkjia.com true http://www.bkjia.com/PHPjc/446396.html techarticle As the database mismanagement leads to data loss, there are no fewer examples of losses for yourself. We're going to talk about this. The following code shows a sample script that runs an SQL statement. In this case ...

