PHP Prevent SQL Injection function Introduction _php tutorial

Specific usage

addslashes Preventing SQL injection

Although many PHP programmers in the country still rely on addslashes to prevent SQL injection, it is recommended to strengthen Chinese to prevent SQL injection check. The problem with addslashes is that hackers can use 0xbf27 instead of single quotes, and addslashes just modifies 0xbf27 to 0xbf5c27 as a valid multibyte character, where 0xbf5c is still considered a single quote, So addslashes can't intercept successfully.

Of course addslashes is not useless, it is used for single-byte string processing, multibyte characters or mysql_real_escape_string bar.

In addition, the PHP manual for GET_MAGIC_QUOTES_GPC

Example:

The code is as follows

function Post_check ($post) { if (!GET_MAGIC_QUOTES_GPC ())//Determine if MAGIC_QUOTES_GPC is open { $post = Addslashes ($post); To filter the submission data without opening the MAGIC_QUOTES_GPC } $post = Str_replace ("_", "_", $post); Filter out the ' _ ' $post = str_replace ("%", "%", $post); Filter out the '% ' $post = NL2BR ($post); Carriage return Conversion $post = Htmlspecialchars ($post); HTML markup Conversions return $post; } ?> Or function Inject_check ($sql _str) { Return eregi (' select|insert|update|delete| ' | function verify_id ($id =null) { if (! $id) {exit (' No arguments are submitted! '); }//Is null-judged ElseIf (Inject_check ($id)) {exit (' argument submitted is illegal! '); }//Injection judgment ElseIf (!is_numeric ($id)) {exit (' argument submitted is illegal! '); }//Digital judgment $id = Intval ($id); The whole type of return $id; } ?>

String mysql_real_escape_string (String $unescaped _string [, Resource $link _identifier])

This function escapes the special characters in unescaped_string and counts the current character set of the connection, so it can be used safely for mysql_query ().

Note:mysql_real_escape_string () does not escape% and _.

Mysql_real_escape_string

Example#1 mysql_real_escape_string () example

code as follows
$item = "Zak s and Derick ' s Laptop"; $escaped _item = mysql_real_escape_string ($item); printf ("Escaped string:%sn", $escaped _item); ?> The above example will produce the following output: Escaped String:zak ' s and Derick ' s Laptop

Mysql_escape_string

This function escapes unescaped_string so that it can be used safely for mysql_query ().

Note: mysql_escape_string () does not escape% and _.

This function is exactly the same as mysql_real_escape_string () except that mysql_real_escape_string () accepts a connection handle and transfers the string in accordance with the current character set. The mysql_escape_string () does not accept the connection parameters, and regardless of the current character set settings.

Example 1. Mysql_escape_string () example

code as follows
!--? php $item =" Zak's Laptop "; $escaped _item = mysql_escape_string ($item); printf (" escaped string:%sn ", $escaped _item); > output: escaped String:zak ' s Laptop

The difference between the 2 functions of mysql_real_escape_string and mysql_escape_string:

Mysql_real_escape_string must be used in cases (PHP 4 >= 4.3.0, PHP 5). Otherwise you can only use mysql_escape_string, the difference between the two is: Mysql_real_escape_string consider the current character set of the connection, and mysql_escape_string not consider.

We can use judgment to deal with it comprehensively.

The code is as follows
function Cleanuserinput ($dirty) { if (GET_MAGIC_QUOTES_GPC ()) { $clean = mysql_real_escape_string (stripslashes ($dirty)); }else{ $clean = mysql_real_escape_string ($dirty); } return $clean; }

To summarize:

* Addslashes () is forcibly added;

* Mysql_real_escape_string () will determine the character set, but the PHP version is required;

* Mysql_escape_string does not consider the current character set of the connection.

http://www.bkjia.com/PHPjc/372028.html www.bkjia.com true http://www.bkjia.com/PHPjc/372028.html techarticle specific usage addslashes prevent SQL injection Although many PHP programmers in the country are still relying on addslashes to prevent SQL injection, it is recommended that you strengthen the Chinese to prevent SQL injection check. Addslashes's question ...

