天天看點

mysql轉義<>_mysql真正的轉義字元串絕對解決sql注入

mysql轉義<>_mysql真正的轉義字元串絕對解決sql注入

I want to know if I add mysql_real_escape_string to my variables that's enough to solve sql injection

$get_id = "select * from `book` where id='".$mysqli->real_escape_string($id)."' limit 1";

解決方案

No, it isn't. Use prepared statements.

You would have to do something like this:

// Your connection settings

$connData = ["localhost", "user", "pass", "database"];

$conn = new mysqli($connData[0], $connData[1], $connData[2], $connData[3]);

$conn->set_charset("utf8");

if ($conn->connect_error) {

die("Connection failed: " . $conn->connect_error);

}

// Here we explain MySQL which will be the query

$stmt = $conn->prepare("select * from book where id=? limit 1");

// Here we tell PHP which variable hash de "?" value. Also you tell PHP that $id has an integer ("i")

$stmt->bind_param("i", $id);

// Here we bind the columns of the query to PHP variables

$stmt->bind_result($column1, $column2, ...); //

// Here we execute the query and store the result

$stmt->execute();

$stmt->store_result();

// Here we store the results of each row in our PHP variables ($column1, column2, ...)

while($stmt->fetch()){

// Now we can do whatever we want (store in array, echo, etc)

echo "

$column1 - $column2 - ...

";

}

$stmt->close();

$conn->close();