I have a question about SQL injection. The website processes a message board and sends it to the PHP controller through ajax for processing $. ajax ({url: 'http: // www. ************? Content = '+ & nbsp; thisContent & nbsp; + & nbsp;' & amp; username = '+ & n about SQL injection
I have a question: the website processes a message board and sends it to the PHP controller through ajax for processing.
$. Ajax ({
Url: 'http: // www .************? Content = '+ thisContent +' & username = '+ thisUsername +' & phone = '+ thisPhone +' & callback =? ',
Type: 'GET ',
DataType: 'jsonp ',
Success: function (d ){
If (d. code = 200 ){
}
}
});
PHP uses GET to access data and directly transmits the data to the MYSql database after receiving the data. but the problem is that the smart user directly enters http: // www in the browser address bar. ************? Content = '+ thisContent +' & username = '+ thisUsername +' & phone = '+ thisPhone +' & callback =? In this way, you can also insert data into the database.
If someone uses the software to continuously transmit data to you through a browser, your MYSql is definitely not affected. It will definitely collapse. Do masters have any good solutions ??? Please answer!
------ Solution --------------------
Limit the number of messages per day based on the username or ip address.
------ Solution --------------------
Reference:
Quote: reference:
Limit the number of messages per day based on the username or ip address.
Thank you for your answers!
I have thought about this based on the user name limit, but it is difficult to determine whether username will be randomly written to MYSQL. It is a good method to restrict IP addresses. However, it is not very common. Is there a better solution?
Is your website Anonymous? No logon restrictions?
Add verification code restrictions
------ Solution --------------------
Make a username judgment before leaving a message to check whether the user exists. if this user is not filled in, return the username to avoid further operations.
Reference:
Quote: reference:
Limit the number of messages per day based on the username or ip address.
Thank you for your answers!
I have thought about this based on the user name limit, but it is difficult to determine whether username will be randomly written to MYSQL. It is a good method to restrict IP addresses. However, it is not very common. Is there a better solution?
