mysql - 防止sql注入

標籤：

使用mysql_real_escape_string 對參數進行轉義

在配合參數化查詢

$query = sprintf("SELECT * FROM Users where UserName=‘%s‘ and Password=‘%s‘",                     mysql_real_escape_string($Username),                     mysql_real_escape_string($Password));  mysql_query($query);  

或者

$db = new mysqli("localhost", "user", "pass", "database");  $stmt = $mysqli -> prepare("SELECT priv FROM testUsers WHERE username=? AND password=?");  $stmt -> bind_param("ss", $user, $pass);  $stmt -> execute();  

 

mysql - 防止sql注入