PHP和CGI的防止SQL注入攻击技巧及措施

// 建立与数据库的连接
$pdo = new PDO("mysql:host=localhost;dbname=database", "user", "password");

// 准备预编译语句
$statement = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// 绑定参数
$statement->bindParam(':username', $username, PDO::PARAM_STR);

// 执行查询
$statement->execute();

// 获取查询结果
$result = $statement->fetchAll(PDO::FETCH_ASSOC);

use DBI;

# 建立与数据库的连接
my $dbh = DBI->connect("DBI:mysql:database=database;host=localhost", "user", "password");

# 准备参数化查询语句
my $sth = $dbh->prepare("SELECT * FROM users WHERE username = ?");

# 绑定参数
$sth->execute($username);

# 获取查询结果
my $result = $sth->fetchrow_hashref();

// 过滤和验证用户输入
$username = $_POST['username'];

if (!filter_var($username, FILTER_VALIDATE_INT)) {
    echo "Invalid username";
}

// 对用户输入进行SQL查询
$query = "SELECT * FROM users WHERE username = " . $username;
$result = mysqli_query($connection, $query);

# 处理用户输入
username = input("Enter your username: ")

# 验证用户输入是否包含特殊字符
if not username.isalnum():
    print("Invalid username")

# 在SQL查询中使用用户输入
query = "SELECT * FROM users WHERE username = %s" % username
result = cursor.execute(query)