Keyword Analysis of php filter SQL Injection-PHP source code

1. Use mysql_real_escape_string instead of addslashes to escape the input. 2. Add single quotation marks on both sides of the field value. 1. Use mysql_real_escape_string to escape the input. 2. Add single quotes on both sides of the Field Value

Script ec (2); script

Replacing update in SQL with str_replace is an error because:

If the SQL statement contains an update field, for example

The Code is as follows:
$ SQL = "update content = 'Update your name .. 'where userid = 1"

So what are the consequences of replacing str_replace? As long as the content submitted by the user contains an update,

Are delete and alter all Tampered? What a terrible thing !!!

So what is the correct solution?

The Code is as follows:
$ Content = mysql tutorial _ real_escape_string ($ content ); $ SQL = "update content = '$ content' where userid = 1