I think MySQL anti-injection is not necessary ah?
Recently in the study of SQL injection prevention, are escaping the user input of some special characters, I do not think it seems necessary ah.
User login, I only allow numbers, letters, underscores, if there are special characters I directly suggest that the wrong, will not dql.
You're right, aren't you?
Share to:
------Solution--------------------
Are you restricting on the client or the server?
------Solution--------------------
Well, the others are doing everything they could to prevent injection.
------Solution--------------------
Quote:
Of course, that's my idea, I don't know if there
's any malpractice
Landlord recently in optimistic heart mischief?
------Solution--------------------
Many advanced systems, as long as they think, can be cracked. We just have to keep the rookie out of the hole. Other fate.
------Solution--------------------
People who want to destroy your program will not use your page as normal people do, they can bypass your input box, such as directly in the address bar operation, if you are not defensive, a gap can let others inject ...
------Solution--------------------
I only allow numbers, letters, underscores
If that's the case, then there really is no database injection.
------Solution--------------------
SQL injection is more than just an input box and a parameter on the address bar
------Solution--------------------
Citation: people
are more advanced systems, as long as they want, can be cracked. We just have to keep the rookie out of the hole. Other fate.
Basic approval.
------Solution--------------------
References:
Quote: References:
Are you restricting on the client or the server?
Server side Ah, PHP regular if found not my allowed characters appear, direct prompt with special characters, will not DQL, and will not give these special characters injected opportunity,
Since the server-side verification, as long as the verification in place, it should be no problem ~ ~ ~
------Solution--------------------
Novice Passing learning
------Solution--------------------
You are already doing anti-injection work when judging the parameters.
------Solution--------------------
Attention, a lot of domestic open source system casually injected, but like Drupal is not, is completely database abstraction layer, can not inject
------------------------------------------------------autocsdn signature file --------------------------------- ---------------------
Yard Farm--code farming code, grazing ideas of the farm!
------Solution--------------------
