The so-called SQL injection attack is an attacker inserting a SQL command into a Web form's input domain or a page request query string, tricking the server into executing a malicious SQL command. In some forms, user-entered content is used directly to construct (or influence) dynamic SQL commands, or as input parameters to stored procedures, which are particularly susceptible to SQL injection attacks.
The first of these methods
<?Php$dsn="Mysql:dbname=study;host=localhost"; $pdo=NewPDO ($DSN,"Root","Root"); //write a preprocessing statement$sql ="INSERT into class values (?,?)";//throws a preprocessing statement to the server for execution, returning the Pdostatement object$stm = $pdoprepare ($sql);//The second time the variable (parameter) is thrown to the server's SQL statement corresponding location, to the preprocessing statement binding parameters$stm->bindparam (1, $Sclass); $stm->bindparam (2, $CLA); $Sclass="7"; $cla="class Seven";//Execution$stm->execute ();
The first method is shorthand
<?Php$dsn="Mysql:dbname=study;host=localhost"; $pdo=NewPDO ($DSN,"Root","Root"); //write a preprocessing statement$sql ="INSERT into class values (?,?)";//throws a preprocessing statement to the server for execution, returning the Pdostatement object$stm = $pdoprepare ($sql);//defining an indexed array$arr = Array ("8","class eight");//Execution$stm->execute ($arr);
The second method of
<?Php$dsn="Mysql:dbname=study;host=localhost"; $pdo=NewPDO ($DSN,"Root","Root");//preprocessing Statements$sql ="INSERT INTO Class VALUES (: SCLASS,:CLA)"; $stm= $pdoprepare ($sql);//Create an array$arr = Array ("Sclass"="Ten","CLA"="Class 10"); //Execution$stm->execute ($arr);
For example, the second case is simple and it is recommended to apply the second method
<body xmlns="http://www.w3.org/1999/html">"pdoycl5.php"Method="Post"/><div> Code: <input type="text"Name="Sclass"> </div><div> class: <input type="text"Name="CLA"> </div><input type="Submit"Value="Add"></form></body>
<?Php$dsn="Mysql:dbname=study;host=localhost"; $pdo=NewPDO ($DSN,"Root","Root");//preprocessing Statements$sql ="INSERT INTO Class VALUES (: SCLASS,:CLA)"; $stm= $pdoprepare ($sql);//Execution$stm->execute ($_post);
PDO preprocessing statement to evade SQL injection attack
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
