Home > Article > Backend Development > PHP能用sprintf函数来防止SQL注入吗？
PHP能用sprintf函数来防止SQL注入吗？
- WBOYOriginal
- 2016-06-23 14:03:221365browse
$sql = sprintf("select count(*) as qty from t_user where f_uid='%s' and f_password='%s'",$password,$userAccount); 这句话能挡住SQL注入吗？
回复讨论(解决方案)
不能，SQL注入的关键在于引号，而sprintf()不会去处理引号。
Statement：
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Previous article：问一下大伙，dedecms数据库连接文件怎么配置呀Next article：检测按钮所在行