Why can this code query the user information of _ id1001?
setAttribute(PDO::ATTR_EMULATE_PREPARES, false);$stmt = $db -> prepare("select * from zhuru where _id=:usid ");$usid = '1001 and 1=0';$stmt->bindParam(':usid',$usid,PDO::PARAM_INT);$exer = $stmt -> execute();while ($rows = $stmt -> fetch(PDO::FETCH_ASSOC)) {echo $rows['username'].'------' . $rows['nickname'].'
';}$db = null;} catch(PDOException $e) {echo $e -> getMessage();}
Why can this code query the user information of _ id = 1001?
Reply to discussion (solution)
Select * from zhuru where _ id =: usid
The actual execution is
Select * from zhuru where _ id = '2017 and 1 = 0'
Unable to meet conditions
To put it back, even if you are not given a single quotation mark
Select * from zhuru where _ id = 1001 and 1 = 0
1 = 0. if the constant is false, the expression is not valid and cannot be found.
The problem is that the user information of _ id = 1001 is found.
Select * from zhuru where _ id =: usid
The actual execution is
Select * from zhuru where _ id = '2017 and 1 = 0'
Unable to meet conditions
To put it back, even if you are not given a single quotation mark
Select * from zhuru where _ id = 1001 and 1 = 0
1 = 0. if the constant is false, the expression is not valid and cannot be found.
The user information of _ id = 1001 is queried during execution.
The actual execution is
Select * from zhuru where _ id = '2017 and 1 = 0'
Because _ id is of the int type, '2014 and 1 = 0' is converted to a value of 1001, which can meet the conditions.
The actual execution is
Select * from zhuru where _ id = '2017 and 1 = 0'
Because _ id is of the int type, '2014 and 1 = 0' is converted to a value of 1001, which can meet the conditions.
How can this problem be solved?
$ Db-> prepare ("select * from zhuru where _ id =: usid ");
: Usid cannot be found with single quotes, even if $ usid = 1001;