PHP prevents SQL injection function usage

Use the Addslashes function in PHP to prevent SQL injection. Although many PHP programmers in the country still rely on addslashes to prevent SQL injection, it is recommended to strengthen Chinese to prevent SQL injection check. The problem with addslashes is that hackers can use 0xbf27 instead of single quotes, and addslashes just modifies 0xbf27 to 0xbf5c27 as a valid multibyte character, where 0xbf5c is still considered a single quote, So addslashes can't intercept successfully. Of course addslashes is not useless, it is used for single-byte string processing, multibyte characters or mysql_real_escape_string bar. Also for the use of the GET_MAGIC_QUOTES_GPC function in the PHP manual, consider the following example. Example: function Post_check ($post) { if (!GET_MAGIC_QUOTES_GPC ())//Determine if MAGIC_QUOTES_GPC is open { $post = Addslashes ($post); To filter the submission data without opening the MAGIC_QUOTES_GPC } $post = Str_replace ("_", "_", $post); Filter out the ' _ ' $post = str_replace ("%", "%", $post); Filter out the '% ' $post = NL2BR ($post); Carriage return Conversion $post = Htmlspecialchars ($post); HTML markup Conversions return $post; } ?> Or function Inject_check ($sql _str) { Return eregi (' select|insert|update|delete| ' | function verify_id ($id =null) { if (! $id) {exit (' No arguments are submitted! '); }//Is null-judged ElseIf (Inject_check ($id)) {exit (' argument submitted is illegal! '); }//Injection judgment ElseIf (!is_numeric ($id)) {exit (' argument submitted is illegal! '); }//Digital judgment $id = Intval ($id); The whole type of return $id; } ?> Copy Code String mysql_real_escape_string (String $unescaped _string [, Resource $link _identifier]) This function escapes the special characters in unescaped_string and counts the current character set of the connection, so it can be used safely for mysql_query (). Note:mysql_real_escape_string () does not escape% and _. Mysql_real_escape_string Example 1,mysql_real_escape_string () $item = "Zak s and Derick ' s Laptop"; $escaped _item = mysql_real_escape_string ($item); printf ("Escaped string:%sn", $escaped _item); ?> Copy Code Output: Escaped String:zak ' s and Derick ' s Laptop Mysql_escape_string This function escapes unescaped_string so that it can be used safely for mysql_query (). Note: mysql_escape_string () does not escape% and _. This function is exactly the same as mysql_real_escape_string () except that mysql_real_escape_string () accepts a connection handle and transfers the string in accordance with the current character set. The mysql_escape_string () does not accept the connection parameters, and regardless of the current character set settings. Example 1. Mysql_escape_string () example $item = "Zak ' s Laptop"; $escaped _item = mysql_escape_string ($item); printf ("Escaped string:%sn", $escaped _item); ?> Copy Code Output: Escaped String:zak ' s Laptop The difference between the 2 functions of mysql_real_escape_string and mysql_escape_string: mysql_real_escape_string must be used in cases (PHP 4 >= 4.3.0, PHP 5). Otherwise you can only use mysql_escape_string, the difference between the two is: Mysql_real_escape_string consider the current character set of the connection, and mysql_escape_string not consider. can use judgment to synthesize the processing. Example: function Cleanuserinput ($dirty) { if (GET_MAGIC_QUOTES_GPC ()) { $clean = mysql_real_escape_string (stripslashes ($dirty)); }else{ $clean = mysql_real_escape_string ($dirty); } return $clean; } Copy Code Summary: * Addslashes () is forcibly added; * Mysql_real_escape_string () will determine the character set, but the PHP version is required; * Mysql_escape_string does not consider the current character set of the connection.

