thinkphp Preventing SQL injection

For Web applications, SQL injection is undoubtedly the primary security issue, and the bottom of the system has a lot of processing and corresponding prevention mechanism for the data security, for example:

$User = M ("User"); Instantiate the User object $user->find ($_get["id"]);

Even if the user enters some malicious ID parameters, the system automatically adds quotation marks to avoid malicious injection. In fact, thinkphp curd all data in the database will be escape_string processed.

The usual security risk is that your query condition uses a string parameter, and then some of these variables depend on the user input from the client, to effectively prevent SQL injection problems, we recommend:

Query conditions use arrays as much as possible, which is a more secure approach;

Turn on the data field type validation, you can cast the numeric data type;

Use automatic validation and auto-completion mechanisms for custom filtering of applications;

field type checking, automatic validation, and auto-completion mechanisms we have described in detail in the model section.

