The most comprehensive approach to preventing SQL injection

The most comprehensive approach to preventing SQL injection

Release time: 2012-04-5 Views: 19361 Category: PHP tutorial

(1) mysql_real_escape_string--escapes special characters in strings used in SQL statements and takes into account the current character set of the connection

Here's how to use it:

1. $sql = "SELECT COUNT (*) as Ctr from users where username
2. = ' ". mysql_real_escape_string($username)."' and
3. Password= ' ". mysql_real_escape_string($pw)." ' Limit 1 ';

mysql_real_escape_string()you can avoid any malicious SQL injection in user input by using a wrapper that is entered as a user.

(2) Open MAGIC_QUOTES_GPC to prevent SQL injection

There is a setting in php.ini: MAGIC_QUOTES_GPC = Off
This is off by default, and if it is turned on, it will automatically convert the query that the user commits to SQL.
For example, "switch to \" And so on, to prevent SQL injection has a major role.

If Magic_quotes_gpc=off, use the addslashes () function

(3) Custom functions

2. function Inject_check($sql _str) {
4. return eregi(' select|insert|and|or|update|delete|\ ' |\/\*|\*|\.\.\/|\.\/|union|into|load_file| OutFile ', $sql _str);
6. }
10. function verify_id($id=null) {
12. if(! $id) {
14. exit(' no submit parameter! ');
16. } ElseIf(inject_check($id)) {
18. exit(' argument submitted is illegal! ');
20. } ElseIf(! Is_numeric($id)) {
22. exit(' argument submitted is illegal! ');
24. }
26. $id = intval($id);
30. return $id;
32. }
38. function Str_check( $str ) {
40. if(! GET_MAGIC_QUOTES_GPC()) {
42. $str = addslashes($str); //Filter
44. }
46. $str = str_replace("_", "\_", $str);
48. $str = str_replace("%", "\%", $str);
52. return $str;
54. }
60. function Post_check($post) {
62. if(! GET_MAGIC_QUOTES_GPC()) {
64. $post = addslashes($post);
66. }
68. $post = str_replace("_", "\_", $post);
70. $post = str_replace("%", "\%", $post);
72. $post = nl2br($post);
74. $post = htmlspecialchars($post);
78. return $post;
80. }

The most comprehensive method of preventing SQL injection