Questions about SQL injection in PHP
I made a little forum myself, and I stumbled across a shot that could be injected. For example: http://localhost/BBS/detail.php?articalID=4
The goal is: to display the article ID 4 post, I now add such a sentence after the sample: Http://localhost/BBS/detail.php?articalID=4 or 1=1, returned the result is all the posts are displayed, Then I saw a function on the Internet:
PHP Code
function Safe ($string) {return "'". Mysql_real_escape_string ($string). "'";}
, the result of using a custom function after the error, this mysql_real_escape_string can give a detailed usage?
How to prevent injections?
------Solution--------------------
PHP Code
function Safe ($string =null) {return addslashes ($string);}
------Solution--------------------
Generally, the value of the integer type obtained by the external (post,get) is used before the intval () conversion, and the string type plus the mysql_real_escape_string () filter is available.
Recommend a related document on the IBM website: