PHP prevents sql injection function usage-PHP Tutorial-php.cn

PHP prevents sql injection function usage

WBOY

Release： 2016-07-25 09:12:22

Original

1267 people have browsed it

Use addslashes function in php to prevent SQL injection.

Although many domestic PHP programmers still rely on addslashes to prevent SQL injection, it is still recommended that everyone strengthen checks to prevent SQL injection in Chinese.

The problem with addslashes is that hackers can use 0xbf27 to replace single quotes, while addslashes only changes 0xbf27 to 0xbf5c27, which becomes a valid multi-byte character. 0xbf5c is still regarded as a single quote, so addslashes cannot successfully intercept.

Of course, addslashes is not useless. It is used for processing single-byte strings. For multi-byte characters, use mysql_real_escape_string.

In addition, for the usage of get_magic_quotes_gpc function in the PHP manual, take a look at the following example.

Example:

function post_check($post)
{
if (!get_magic_quotes_gpc()) // Determine whether magic_quotes_gpc is open
{
$post = addslashes($post); // Perform magic_quotes_gpc Filter the submitted data when it is not opened
}
$post = str_replace("_", "_", $post); // Filter out '_'
$post = str_replace("%", "%" , $post); // Filter out ' % '
$post = nl2br($post); // Enter conversion
$post= htmlspecialchars($post); // html tag conversion
return $post;
}
?>
or
function inject_check($sql_str)
{
return eregi('select|insert|update|delete|'|
function verify_id($id=null)
{
if (! $id) { exit('No parameters submitted!'); } // Judgment of whether it is empty
elseif (inject_check($id)) { exit('The parameters submitted are illegal!'); } // Judgment of injection
elseif ( !is_numeric($id)) { exit('The submitted parameter is illegal!'); } // Numeric judgment
$id = intval($id); // Integerization
return $id;
}
?>

Copy code

string mysql_real_escape_string ( string $unescaped_string [, resource $link_identifier ] )

This function escapes special characters in unescaped_string and takes into account the current character set of the connection, so it can be used safely with mysql_query().

Note: mysql_real_escape_string() does not escape % and _.

mysql_real_escape_string

Example 1, mysql_real_escape_string() example

$item = "Zak's and Derick's Laptop" ;
$escaped_item = mysql_real_escape_string ( $item );
printf ( "Escaped string: %sn" , $escaped_item );
?>

Copy code

Output: Escaped string: Zak's and Derick's Laptop

mysql_escape_string This function escapes an unescaped_string, making it safe for use with mysql_query(). Note: mysql_escape_string() does not escape % and _. This function is exactly the same as mysql_real_escape_string(), except that mysql_real_escape_string() accepts a connection handle and transfers the string according to the current character set. mysql_escape_string() does not accept connection parameters and does not care about the current character set setting.

Example 1. mysql_escape_string() example

$item = "Zak's Laptop";
$escaped_item = mysql_escape_string($item);
printf ("Escaped string: %sn", $escaped_item);
?>

Copy code

Output: Escaped string: Zak's Laptop

The difference between the two functions mysql_real_escape_string and mysql_escape_string: mysql_real_escape_string can only be used when (PHP 4 >= 4.3.0, PHP 5). Otherwise, you can only use mysql_escape_string. The difference between the two is: mysql_real_escape_string takes into account the current character set of the connection, while mysql_escape_string does not. Judgment can be used for comprehensive processing.

Example:

function cleanuserinput($dirty){
if (get_magic_quotes_gpc()) {
$clean = mysql_real_escape_string(stripslashes($dirty));
}else{
$clean = mysql_real_e scape_string($ dirty);
}
return $clean;
}

Copy code

Summary: * addslashes() is forcibly added; * mysql_real_escape_string() will determine the character set, but there are requirements for the PHP version; * mysql_escape_string does not take into account the current character set of the connection.