The example of this article describes how to prevent SQL injection by PHP + mysql. To share with you for your reference, as follows:
SQL injection
Example: script logic
$sql = "SELECT * FROM user WHERE userid = $_GET[userid] ";
Case 1:
Case 2:
Case 3:
Monitor the following methods
Sleep() – the general SQL blind annotation will be accompanied by the sleep() function, and generally sleep is at least 5 seconds
MID()
CHAR()
ORD()
SYSDATE()
SUBSTRING()
DATABASES()
SCHEMA()
USER()
VERSION()
CURRENT_USER()
LOAD_FILE()
OUTFILE/DUMPFILE
INFORMATION_SCHEMA
TABLE_NAME
Fwrite () /fopen () /file get contents () – these are PHP file manipulation functions
Response:
1.mysql_escape_string()Escape special characters ((PHP 4 > = 4.3.0, PHP 5)) (mysql_real_escape_string must be linked to the database first, otherwise an error will be reported)
The following characters are affected:
\X00 / / null corresponding to ASCII character
\N / / newline and back to the top of the next line
\R / / line break
\/ / escape character
‘
“
\X1a / / hexadecimal number
If successful, the function returns the escaped string. If it fails, it returns false.
2.addslashes(): function returns a string that adds a backslash before a predefined character（stripslashes()Implement string restore)
Predefined characters are:
Single quotation mark (‘)
Double quotes (“)
Backslash (\)
NULL
3. Prepared statements
<?php
$mysqli = new mysqli("example.com", "user", "password", "database");
if ($mysqli->connect_errno) {
echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}
/* Non-prepared statement */
if (!$mysqli->query("DROP TABLE IF EXISTS test") || !$mysqli->query("CREATE TABLE test(id INT)")) {
echo "Table creation failed: (" . $mysqli->errno . ") " . $mysqli->error;
}
/* Prepared statement, stage 1: prepare */
if (!($stmt = $mysqli->prepare("INSERT INTO test(id) VALUES (?)"))) {
echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
}
/* Prepared statement, stage 2: bind and execute */
$id = 1;
if (!$stmt->bind_param("i", $id)) {
echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
}
if (!$stmt->execute()) {
echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
}
?>
For more information about PHP, you can see the following topics: PHP programming security tutorial, PHP security filtering skills summary, PHP operation and operator usage summary, PHP basic syntax tutorial, PHP object-oriented programming tutorial, PHP string usage summary, PHP + MySQL database operation tutorial 》And PHP common database operation skills summary
I hope that this article will be helpful for PHP programming.