用PHP函數(shù)解決SQL injection
Jun 01, 2016 pm 02:28 PMSQL injection問題在asp上可是鬧得沸沸揚揚當然還有不少國內(nèi)外著名的php程序“遇難”。至于SQL injection的詳情,網(wǎng)上的文章太多了,在此就不作介紹。
如果你網(wǎng)站空間的php.ini文件里的magic_quotes_gpc設成了off,那么PHP就不會在敏感字符前加上反斜杠(\),由于表單提交的內(nèi)容可能含有敏感字符,如單引號('),就導致了SQL injection的漏洞。在這種情況下,我們可以用addslashes()來解決問題,它會自動在敏感字符前添加反斜杠。
但是,上面的方法只適用于magic_quotes_gpc=Off的情況。作為一個開發(fā)者,你不知道每個用戶的magic_quotes_gpc是On還是Off,如果把全部的數(shù)據(jù)都用上addslashes(),那不是“濫殺無辜”了?假如magic_quotes_gpc=On,并且又用了addslashes()函數(shù),那讓我們來看看: //如果從表單提交一個變量$_POST['message'],內(nèi)容為 Tom's book
//這此加入連接MySQL數(shù)據(jù)庫的代碼,自己寫吧
//在$_POST['message']的敏感字符前加上反斜杠
$_POST['message'] = addslashes($_POST['message']);
//由于magic_quotes_gpc=On,所以又一次在敏感字符前加反斜杠
$sql = "INSERT INTO msg_table VALUE('$_POST[message]');";
//發(fā)送請求,把內(nèi)容保存到數(shù)據(jù)庫內(nèi)
$query = mysql_query($sql);
//如果你再從數(shù)據(jù)庫內(nèi)提取這個記錄并輸出,就會看到 Tom\'s book
?>
這樣的話,在magic_quotes_gpc=On的環(huán)境里,所有輸入的單引號(')都會變成(\')……
其實我們可以用get_magic_quotes_gpc()函數(shù)輕易地解決這個問題。當magic_quotes_gpc=On時,該函數(shù)返回TRUE;當magic_quotes_gpc=Off時,返回FALSE。至此,肯定已經(jīng)有不少人意識到:問題已經(jīng)解決。請看代碼: //如果magic_quotes_gpc=Off,那就為提單提交的$_POST['message']里的敏感字符加反斜杠
//magic_quotes_gpc=On的情況下,則不加
if (!get_magic_quotes_gpc()) {
$_POST['message'] = addslashes($_POST['message']);
} else {}
?>
其實說到這里,問題已經(jīng)解決。下面再說一個小技巧。
有時表單提交的變量不止一個,可能有十幾個,幾十個。那么一次一次地復制/粘帖addslashes(),是否麻煩了一點?由于從表單或URL獲取的數(shù)據(jù)都是以數(shù)組形式出現(xiàn)的,如$_POST、$_GET)那就自定義一個可以“橫掃千軍”的函數(shù): function quotes($content)
{
//如果magic_quotes_gpc=Off,那么就開始處理
if (!get_magic_quotes_gpc()) {
//判斷$content是否為數(shù)組
if (is_array($content)) {
//如果$content是數(shù)組,那么就處理它的每一個單無
foreach ($content as $key=>$value) {
$content[$key] = addslashes($value);
}
} else {
//如果$content不是數(shù)組,那么就僅處理一次
addslashes($content);
}
} else {
//如果magic_quotes_gpc=On,那么就不處理
}
//返回$content
return $content;
}
?>
?

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

TosecurelyhandleauthenticationandauthorizationinPHP,followthesesteps:1.Alwayshashpasswordswithpassword_hash()andverifyusingpassword_verify(),usepreparedstatementstopreventSQLinjection,andstoreuserdatain$_SESSIONafterlogin.2.Implementrole-basedaccessc

To safely handle file uploads in PHP, the core is to verify file types, rename files, and restrict permissions. 1. Use finfo_file() to check the real MIME type, and only specific types such as image/jpeg are allowed; 2. Use uniqid() to generate random file names and store them in non-Web root directory; 3. Limit file size through php.ini and HTML forms, and set directory permissions to 0755; 4. Use ClamAV to scan malware to enhance security. These steps effectively prevent security vulnerabilities and ensure that the file upload process is safe and reliable.

In PHP, the main difference between == and == is the strictness of type checking. ==Type conversion will be performed before comparison, for example, 5=="5" returns true, and ===Request that the value and type are the same before true will be returned, for example, 5==="5" returns false. In usage scenarios, === is more secure and should be used first, and == is only used when type conversion is required.

The methods of using basic mathematical operations in PHP are as follows: 1. Addition signs support integers and floating-point numbers, and can also be used for variables. String numbers will be automatically converted but not recommended to dependencies; 2. Subtraction signs use - signs, variables are the same, and type conversion is also applicable; 3. Multiplication signs use * signs, which are suitable for numbers and similar strings; 4. Division uses / signs, which need to avoid dividing by zero, and note that the result may be floating-point numbers; 5. Taking the modulus signs can be used to judge odd and even numbers, and when processing negative numbers, the remainder signs are consistent with the dividend. The key to using these operators correctly is to ensure that the data types are clear and the boundary situation is handled well.

Yes, PHP can interact with NoSQL databases like MongoDB and Redis through specific extensions or libraries. First, use the MongoDBPHP driver (installed through PECL or Composer) to create client instances and operate databases and collections, supporting insertion, query, aggregation and other operations; second, use the Predis library or phpredis extension to connect to Redis, perform key-value settings and acquisitions, and recommend phpredis for high-performance scenarios, while Predis is convenient for rapid deployment; both are suitable for production environments and are well-documented.

TostaycurrentwithPHPdevelopmentsandbestpractices,followkeynewssourceslikePHP.netandPHPWeekly,engagewithcommunitiesonforumsandconferences,keeptoolingupdatedandgraduallyadoptnewfeatures,andreadorcontributetoopensourceprojects.First,followreliablesource

PHPbecamepopularforwebdevelopmentduetoitseaseoflearning,seamlessintegrationwithHTML,widespreadhostingsupport,andalargeecosystemincludingframeworkslikeLaravelandCMSplatformslikeWordPress.Itexcelsinhandlingformsubmissions,managingusersessions,interacti

TosettherighttimezoneinPHP,usedate_default_timezone_set()functionatthestartofyourscriptwithavalididentifiersuchas'America/New_York'.1.Usedate_default_timezone_set()beforeanydate/timefunctions.2.Alternatively,configurethephp.inifilebysettingdate.timez
