Introduction to PHP's function to prevent SQL injection

Specific usage

addslashes prevents SQL injection

Although many domestic PHP programmers are still relying on addslashes to prevent SQL injection, it is recommended that you strengthen the Chinese to prevent SQL injection inspection. The problem with addslashes is that hackers can use 0xbf27 instead of single quotes, and addslashes only modifies 0xbf27 to 0xbf5c27 as a valid multi-byte character, where the 0xbf5c is still considered single quotes, So addslashes cannot successfully intercept.

Of course, addslashes is also not useless, it is used for single-byte string processing, multibyte characters or use mysql_real_escape_string bar.

In addition to the PHP manual in the GET_MAGIC_QUOTES_GPC

Example:

code as follows

<?php Function Post_check ($post) { If (!GET_MAGIC_QUOTES_GPC ())//To determine if MAGIC_QUOTES_GPC is open { $post = addslashes ($post); The filter for submitting data is not opened by GPC } $post = Str_replace ("_", "_", $post);//Filter out ' _ ' to $post = str_replace ("%", "%", $post) ; Filter '% ' out of the $post = NL2BR ($post);//return conversion $post = Htmlspecialchars ($post);//html tag conversion return $post; } or <?php Function Inject_check ($sql _str) { return eregi (' Select|insert|up Date|delete| ' | Function verify_id ($id =null) { if (! $id) {exit (' No submit parameters! '); }//Is NULL to Judge ElseIf (Inject_check ($id)) {exit (' submitted parameter illegal! '); ///Injection judgment ElseIf (!is_numeric ($id)) {exit (' submitted parameter illegal! '); //number judgment $id = Intval ($id);//int return $id; }

String mysql_real_escape_string (String $unescaped _string [, Resource $link _identifier])

This function escape the special character in Unescaped_string and is counted as the current character set of the connection, so it can be used safely for mysql_query ().

Note:mysql_real_escape_string () does not escape% and _.

Mysql_real_escape_string

Example#1 mysql_real_escape_string () example

The code is as follows
<?php $item = "Zak ' s and Derick ' s laptop"; $escaped _item = mysql_real_escape_string ($item); printf ("Escaped string:%sn", $escaped _item); ?> The above example produces the following output: Escaped String:zak ' s and Derick ' s laptop

Mysql_escape_string

This function escapes unescaped_string so that it can be used securely for mysql_query ().

Note: mysql_escape_string () does not escape% and _.

This function is exactly the same as mysql_real_escape_string () except that mysql_real_escape_string () accepts a connection handle and transfers the string based on the current character set. Mysql_escape_string () does not accept connection parameters or the current character set settings.

Example 1. Mysql_escape_string () example

The code is as follows
<?php $item = "Zak ' s laptop"; $escaped _item = mysql_escape_string ($item); printf ("Escaped string:%sn", $escaped _item); ?> Output: Escaped String:zak ' s laptop

The difference between the 2 functions of mysql_real_escape_string and mysql_escape_string:

Mysql_real_escape_string must be available in the case of (PHP 4 >= 4.3.0, PHP 5). Otherwise, only mysql_escape_string can be used, and the difference is that mysql_real_escape_string takes into account the current character set of the connection, and Mysql_escape_string does not consider it.

We can use judgment to deal with it comprehensively.

The code is as follows
function Cleanuserinput ($dirty) { if (GET_MAGIC_QUOTES_GPC ()) { $clean = mysql_real_escape_string (stripslashes ($dirty)); }else{ $clean = mysql_real_escape_string ($dirty); } return $clean; }

To sum up:

* Addslashes () is forcibly added;

* Mysql_real_escape_string () will judge the character set, but the PHP version is required;

* Mysql_escape_string does not consider the current character set of the connection.