PHP How to do database attacks (e.g. SQL injection) _php tutorial

PHP mysql_real_escape_string () function

PHP MySQL functions

Definition and usage

The mysql_real_escape_string () function escapes special characters in strings used in SQL statements.

The following characters are affected:

\x00\n\r\ ' "\x1a

If successful, the function returns the escaped string. If it fails, it returns false.

Grammar

Mysql_real_escape_string (string,connection)

Parameters	Description
String	Necessary. Specifies the string to be escaped.
Connection	Optional. Specify MySQL connection. If not specified, the previous connection is used.

Description

This function escapes the special characters in the string and takes into account the current character set of the connection, so it can be used safely for mysql_query ().

Hints and Notes

Tip: You can use this function to prevent database attacks.

Example

Example 1

 
  mysql_real_escape_string($pwd); $sql = "SELECT * from Users whereuser= '". $user. "' and password= '". $pwd. "'"//More Code mysql_close ($con);? >

Example 2

Database attacks. This example shows what happens if we do not apply the mysql_real_escape_string () function to the username and password:

Then the SQL query will be like this:

SELECT * from Userswhere user= ' John ' and password= ' OR ' = '

This means that any user can log in without entering a valid password.

Example 3

The right way to prevent database attacks:

 
  Stripslashes ($value);  } If it is not a number, quote if (!is_numeric ($value))  {  mysql_real_escape_string($value) . "'";  } return $value;} $con = mysql_connect ("localhost", "Hello", "321"), if (! $con)  {die  (' Could not connect: '. Mysql_error ());  } Secure Sql$user = check_input ($_post[' user "), $pwd = Check_input ($_post[' pwd '); $sql =" SELECT * from Users whereuser= $u Ser and password= $pwd "; mysql_query ($sql); Mysql_close ($con);? >

http://www.bkjia.com/PHPjc/735865.html www.bkjia.com true http://www.bkjia.com/PHPjc/735865.html techarticle The php mysql_real_escape_string () function defines and uses the PHP MySQL function mysql_real_escape_string () function to escape the special characters in the string used in the SQL statement. The following characters are affected by the shadow ...

