Php+mysql ways to prevent SQL injection

This article introduces the content is about php+mysql to prevent SQL injection method, has a certain reference value, now share to everyone, the need for friends can refer to

Method One:

Mysql_real_escape_string--escapes special characters in strings used in SQL statements and takes into account the current character set of the connection!

$sql = "SELECT count (*) as Ctr from users where Username= '". Mysql_real_escape_string ($username). "' and password= '". Mysql_real_escape_string ($PW). "' Limit 1";

Method Two:

Open MAGIC_QUOTES_GPC to prevent SQL injection. There is a setting in php.ini: MAGIC_QUOTES_GPC = Off is turned off by default, and if it is turned on, it will automatically convert the user's query to SQL, such as ' turn to \ ' and so on, which is important to prevent SQL injection.

if Magic_quotes_gpc=off, the addslashes () function is used.

Method Three:

Custom functions

/*** prevent SQL Injection custom method one * author:xiaochuan* @param: Mixed $value parameter value */function Check_param ($value =null) {# select|i Nsert|update|delete|\ ' |\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile $str = ' select|insert|and|or|update|     Delete|\ ' |\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile '; if (! $value) {exit (' no arguments!      '); }elseif (Eregi ($str, $value)) {exit (' argument is illegal!     '); } return true; }/*** prevent SQL injection custom method two * author:xiaochuan* @param: Mixed $value parameter value */function Str_check ($value) {if (!get_ma      GIC_QUOTES_GPC ()) {//Filter $value = addslashes ($value);      } $value = Str_replace ("_", "\_", $value);          $value = str_replace ("%", "\%", $value); return $value; }/*** prevent SQL injection custom method three * author:xiaochuan* @param: Mixed $value parameter value */function Post_check ($value) {if (!get_magi     C_QUOTES_GPC ()) {//Filter $value = addslashes ($value);      } $value = Str_replace ("_", "\_", $value); $value = str_replace ("%", "\%", $value);      $value = NL2BR ($value);      $value = Htmlspecialchars ($value); return $value; }