Home > Backend Development > PHP Tutorial > PHP PDO 安全执行 set names utf8 的正确方法

PHP PDO 安全执行 set names utf8 的正确方法

WBOY
Release: 2016-06-23 13:28:04
Original
1632 people have browsed it

代码

<?phpdefine('DB_HOST', 'localhost');define('DB_SCHEMA', 'test');define('DB_USER', 'test');define('DB_PASSWORD', 'test');define('DB_ENCODING', 'utf8');$dsn = 'mysql:host=' . DB_HOST . ';dbname=' . DB_SCHEMA;$options = array(    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,);if( version_compare(PHP_VERSION, '5.3.6', '<') ){    if( defined('PDO::MYSQL_ATTR_INIT_COMMAND') ){        $options[PDO::MYSQL_ATTR_INIT_COMMAND] = 'SET NAMES ' . DB_ENCODING;    }}else{    $dsn .= ';charset=' . DB_ENCODING;}$conn = @new PDO($dsn, DB_USER, DB_PASSWORD, $options);if( version_compare(PHP_VERSION, '5.3.6', '<') && !defined('PDO::MYSQL_ATTR_INIT_COMMAND') ){    $sql = 'SET NAMES ' . DB_ENCODING;    $conn->exec($sql);}
Copy after login
PDO 注入方法

其他的比如直接执行 set names utf8是老版本的PHP,因为不支持绑定,所以才只能这样。但存在注入漏洞。
老版本PHP 的 PDO 注入方法,链接:
(将PHP升级到最新稳定版本,再使用如上代码,可以解决该注入问题)

版权声明:本文为博主原创文章,未经博主允许不得转载。

source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template