Introduction to PHP functions to prevent SQL injection_PHP tutorial

Specific usage

Addslashes prevent SQL injection

Although many domestic PHP programmers still rely on addslashes to prevent SQL injection, it is recommended that everyone strengthen checks to prevent SQL injection in Chinese. The problem with addslashes is that hackers can use 0xbf27 instead of single quotes, while addslashes only changes 0xbf27 to 0xbf5c27, which becomes a valid multi-byte character. 0xbf5c is still regarded as a single quote, so addslashes cannot successfully intercept.

Of course, addslashes is not useless. It is used for processing single-byte strings. For multi-byte characters, use mysql_real_escape_string.

In addition, for the get_magic_quotes_gpc in the php manual

Example:

The code is as follows

function post_check($post) { if (!get_magic_quotes_gpc()) // Determine whether magic_quotes_gpc is turned on { $post = addslashes($post); // Filter submitted data when magic_quotes_gpc is not turned on } $post = str_replace("_", "_", $post); // Filter out '_' $post = str_replace("%", "%", $post); // Filter out '%' $post = nl2br($post); // Enter conversion $post= htmlspecialchars($post); // html tag conversion return $post; } ?> or function inject_check($sql_str) { return eregi('select|insert|update|delete|'| function verify_id($id=null) { if (!$id) { exit('No parameters submitted!'); } // Determine whether it is empty elseif (inject_check($id)) { exit('The submitted parameter is illegal!'); } // Injection judgment elseif (!is_numeric($id)) { exit('The submitted parameters are illegal!'); } // Numeric judgment $id = intval($id); // Integer return $id; } ?>

String mysql_real_escape_string ( string $unescaped_string [, resource $link_identifier ] )

This function escapes special characters in unescaped_string and takes into account the current character set of the connection, so it can be used safely with mysql_query().

Note: mysql_real_escape_string() does not escape % and _.

mysql_real_escape_string

Example#1 mysql_real_escape_string() Example

The code is as follows

$item = "Zak's and Derick's Laptop" ;
$escaped_item = mysql_real_escape_string ( $item );
printf ( "Escaped string: %sn" , $escaped_item );
?>

代码如下
$item = "Zak's and Derick's Laptop" ; $escaped_item = mysql_real_escape_string ( $item ); printf ( "Escaped string: %sn" , $escaped_item ); ?> 以上例子将产生如下输出： Escaped string: Zak's and Derick's Laptop

The above example will produce the following output:

Escaped string: Zak's and Derick's Laptop

mysql_escape_string

This function escapes unescaped_string so that it can be safely used in mysql_query().

Note: mysql_escape_string() does not escape % and _.

This function is exactly the same as mysql_real_escape_string(), except that mysql_real_escape_string() accepts a connection handle and transfers the string according to the current character set. mysql_escape_string() does not accept connection parameters and does not care about the current character set setting.

Example 1. mysql_escape_string() Example

The code is as follows

$item = "Zak's Laptop";
$escaped_item = mysql_escape_string($item);
printf ("Escaped string: %sn", $escaped_item);
?>
Output:
Escaped string: Zak's Laptop

代码如下
$item = "Zak's Laptop"; $escaped_item = mysql_escape_string($item); printf ("Escaped string: %sn", $escaped_item); ?> 输出： Escaped string: Zak's Laptop

The difference between the two functions mysql_real_escape_string and mysql_escape_string:

Mysql_real_escape_string can only be used under (PHP 4 >= 4.3.0, PHP 5). Otherwise, you can only use mysql_escape_string. The difference between the two is: mysql_real_escape_string takes into account the current character set of the connection, while mysql_escape_string does not.

We can use judgment to handle it comprehensively

代码如下
function cleanuserinput($dirty){ if (get_magic_quotes_gpc()) { $clean = mysql_real_escape_string(stripslashes($dirty)); }else{ $clean = mysql_real_escape_string($dirty); } return $clean; }

To summarize:

* addslashes() is a forced addition;

* mysql_real_escape_string() will determine the character set, but there are requirements for the PHP version;

* mysql_escape_string does not consider the current character set of the connection.

http://www.bkjia.com/PHPjc/372028.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/372028.htmlTechArticleSpecific usage of addslashes to prevent SQL injection. Although many domestic PHP programmers still rely on addslashes to prevent SQL injection, it is recommended that you strengthen it. Chinese check to prevent SQL injection. A question from addslashes...