PHP Prevent SQL Injection function Introduction _php tutorial

Source: Internet
Author: User
Tags derick
Specific usage

addslashes Preventing SQL injection

Although many PHP programmers in the country still rely on addslashes to prevent SQL injection, it is recommended to strengthen Chinese to prevent SQL injection check. The problem with addslashes is that hackers can use 0xbf27 instead of single quotes, and addslashes just modifies 0xbf27 to 0xbf5c27 as a valid multibyte character, where 0xbf5c is still considered a single quote, So addslashes can't intercept successfully.

Of course addslashes is not useless, it is used for single-byte string processing, multibyte characters or mysql_real_escape_string bar.

In addition, the PHP manual for GET_MAGIC_QUOTES_GPC

Example:

The code is as follows


function Post_check ($post)
{
if (!GET_MAGIC_QUOTES_GPC ())//Determine if MAGIC_QUOTES_GPC is open
{
$post = Addslashes ($post); To filter the submission data without opening the MAGIC_QUOTES_GPC
}
$post = Str_replace ("_", "_", $post); Filter out the ' _ '
$post = str_replace ("%", "%", $post); Filter out the '% '
$post = NL2BR ($post); Carriage return Conversion
$post = Htmlspecialchars ($post); HTML markup Conversions
return $post;
}
?>

Or

function Inject_check ($sql _str)
{
Return eregi (' select|insert|update|delete| ' |
function verify_id ($id =null)
{
if (! $id) {exit (' No arguments are submitted! '); }//Is null-judged
ElseIf (Inject_check ($id)) {exit (' argument submitted is illegal! '); }//Injection judgment
ElseIf (!is_numeric ($id)) {exit (' argument submitted is illegal! '); }//Digital judgment
$id = Intval ($id); The whole type of
return $id;
}
?>

String mysql_real_escape_string (String $unescaped _string [, Resource $link _identifier])

This function escapes the special characters in unescaped_string and counts the current character set of the connection, so it can be used safely for mysql_query ().

Note:mysql_real_escape_string () does not escape% and _.

Mysql_real_escape_string

Example#1 mysql_real_escape_string () example

code as follows

$item = "Zak s and Derick ' s Laptop";
$escaped _item = mysql_real_escape_string ($item);
printf ("Escaped string:%sn", $escaped _item);
?>

The above example will produce the following output:

Escaped String:zak ' s and Derick ' s Laptop

Mysql_escape_string

This function escapes unescaped_string so that it can be used safely for mysql_query ().

Note: mysql_escape_string () does not escape% and _.

This function is exactly the same as mysql_real_escape_string () except that mysql_real_escape_string () accepts a connection handle and transfers the string in accordance with the current character set. The mysql_escape_string () does not accept the connection parameters, and regardless of the current character set settings.

Example 1. Mysql_escape_string () example

code as follows

!--? php
$item =" Zak's Laptop ";
$escaped _item = mysql_escape_string ($item);
printf (" escaped string:%sn ", $escaped _item);
>
output:
escaped String:zak ' s Laptop

The difference between the 2 functions of mysql_real_escape_string and mysql_escape_string:

Mysql_real_escape_string must be used in cases (PHP 4 >= 4.3.0, PHP 5). Otherwise you can only use mysql_escape_string, the difference between the two is: Mysql_real_escape_string consider the current character set of the connection, and mysql_escape_string not consider.

We can use judgment to deal with it comprehensively.

The code is as follows
function Cleanuserinput ($dirty) {
if (GET_MAGIC_QUOTES_GPC ()) {
$clean = mysql_real_escape_string (stripslashes ($dirty));
}else{
$clean = mysql_real_escape_string ($dirty);
}
return $clean;
}

To summarize:

* Addslashes () is forcibly added;

* Mysql_real_escape_string () will determine the character set, but the PHP version is required;

* Mysql_escape_string does not consider the current character set of the connection.

http://www.bkjia.com/PHPjc/372028.html www.bkjia.com true http://www.bkjia.com/PHPjc/372028.html techarticle specific usage addslashes prevent SQL injection Although many PHP programmers in the country are still relying on addslashes to prevent SQL injection, it is recommended that you strengthen the Chinese to prevent SQL injection check. Addslashes's question ...

  • Contact Us

    The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

    If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

    A Free Trial That Lets You Build Big!

    Start building with 50+ products and up to 12 months usage for Elastic Compute Service

    • Sales Support

      1 on 1 presale consultation

    • After-Sales Support

      24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.