SQL injection Attack of network attack and defense

The root cause of SQL injection attacks is the vulnerability of SQL specifications, but because of the long-term existence and use of the specification, it is almost impossible to modify the specification, only from the developer itself to avoid attacks, although the SQL injection is very serious, but now relatively well controlled, here just as a learning content.
The test process is as follows:
1: Build php,mysql development environment, can see my other blog custom development PHP Environment
2: Add database, table, and table contents.

3: Test separately
Universal password, Universal user name
Digital injection
The test is as follows:
Universal Password: password ' or 1= ' 1 (password can be arbitrarily filled in, note: here if the paste will have coding problems, self-modification)
Universal User name: XX ' UNION SELECT * FROM testuser/* (mysql5.6 version test does not have this problem)
The digital injection is injected with the user name and only the number is submitted.

How do you prevent SQL injection?
1: Modify the server configuration: Modify the MAGIC_QUOTES_GPC setting to On (php5.3 above version does not have this setting)
2: In the code layer to modify, you can use a more rigorous validation method;
3: Use PDO to pre-compile processing.

SQL injection Attack of network attack and defense