国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Home Backend Development PHP Tutorial 用PHP函數(shù)解決SQL injection

用PHP函數(shù)解決SQL injection

Jun 01, 2016 pm 02:28 PM

SQL injection問題在asp上可是鬧得沸沸揚揚當然還有不少國內(nèi)外著名的php程序“遇難”。至于SQL injection的詳情,網(wǎng)上的文章太多了,在此就不作介紹。
如果你網(wǎng)站空間的php.ini文件里的magic_quotes_gpc設成了off,那么PHP就不會在敏感字符前加上反斜杠(\),由于表單提交的內(nèi)容可能含有敏感字符,如單引號('),就導致了SQL injection的漏洞。在這種情況下,我們可以用addslashes()來解決問題,它會自動在敏感字符前添加反斜杠。
但是,上面的方法只適用于magic_quotes_gpc=Off的情況。作為一個開發(fā)者,你不知道每個用戶的magic_quotes_gpc是On還是Off,如果把全部的數(shù)據(jù)都用上addslashes(),那不是“濫殺無辜”了?假如magic_quotes_gpc=On,并且又用了addslashes()函數(shù),那讓我們來看看: //如果從表單提交一個變量$_POST['message'],內(nèi)容為 Tom's book
//這此加入連接MySQL數(shù)據(jù)庫的代碼,自己寫吧
//在$_POST['message']的敏感字符前加上反斜杠
$_POST['message'] = addslashes($_POST['message']);

//由于magic_quotes_gpc=On,所以又一次在敏感字符前加反斜杠
$sql = "INSERT INTO msg_table VALUE('$_POST[message]');";

//發(fā)送請求,把內(nèi)容保存到數(shù)據(jù)庫內(nèi)
$query = mysql_query($sql);

//如果你再從數(shù)據(jù)庫內(nèi)提取這個記錄并輸出,就會看到 Tom\'s book
?>

這樣的話,在magic_quotes_gpc=On的環(huán)境里,所有輸入的單引號(')都會變成(\')……
其實我們可以用get_magic_quotes_gpc()函數(shù)輕易地解決這個問題。當magic_quotes_gpc=On時,該函數(shù)返回TRUE;當magic_quotes_gpc=Off時,返回FALSE。至此,肯定已經(jīng)有不少人意識到:問題已經(jīng)解決。請看代碼: //如果magic_quotes_gpc=Off,那就為提單提交的$_POST['message']里的敏感字符加反斜杠
//magic_quotes_gpc=On的情況下,則不加
if (!get_magic_quotes_gpc()) {
$_POST['message'] = addslashes($_POST['message']);
} else {}
?>
其實說到這里,問題已經(jīng)解決。下面再說一個小技巧。
有時表單提交的變量不止一個,可能有十幾個,幾十個。那么一次一次地復制/粘帖addslashes(),是否麻煩了一點?由于從表單或URL獲取的數(shù)據(jù)都是以數(shù)組形式出現(xiàn)的,如$_POST、$_GET)那就自定義一個可以“橫掃千軍”的函數(shù): function quotes($content)
{
//如果magic_quotes_gpc=Off,那么就開始處理
if (!get_magic_quotes_gpc()) {
//判斷$content是否為數(shù)組
if (is_array($content)) {
//如果$content是數(shù)組,那么就處理它的每一個單無
foreach ($content as $key=>$value) {
$content[$key] = addslashes($value);
}
} else {
//如果$content不是數(shù)組,那么就僅處理一次
addslashes($content);
}
} else {
//如果magic_quotes_gpc=On,那么就不處理
}
//返回$content
return $content;
}
?>


?

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How do I implement authentication and authorization in PHP? How do I implement authentication and authorization in PHP? Jun 20, 2025 am 01:03 AM

TosecurelyhandleauthenticationandauthorizationinPHP,followthesesteps:1.Alwayshashpasswordswithpassword_hash()andverifyusingpassword_verify(),usepreparedstatementstopreventSQLinjection,andstoreuserdatain$_SESSIONafterlogin.2.Implementrole-basedaccessc

How can you handle file uploads securely in PHP? How can you handle file uploads securely in PHP? Jun 19, 2025 am 01:05 AM

To safely handle file uploads in PHP, the core is to verify file types, rename files, and restrict permissions. 1. Use finfo_file() to check the real MIME type, and only specific types such as image/jpeg are allowed; 2. Use uniqid() to generate random file names and store them in non-Web root directory; 3. Limit file size through php.ini and HTML forms, and set directory permissions to 0755; 4. Use ClamAV to scan malware to enhance security. These steps effectively prevent security vulnerabilities and ensure that the file upload process is safe and reliable.

What are the differences between == (loose comparison) and === (strict comparison) in PHP? What are the differences between == (loose comparison) and === (strict comparison) in PHP? Jun 19, 2025 am 01:07 AM

In PHP, the main difference between == and == is the strictness of type checking. ==Type conversion will be performed before comparison, for example, 5=="5" returns true, and ===Request that the value and type are the same before true will be returned, for example, 5==="5" returns false. In usage scenarios, === is more secure and should be used first, and == is only used when type conversion is required.

How do I perform arithmetic operations in PHP ( , -, *, /, %)? How do I perform arithmetic operations in PHP ( , -, *, /, %)? Jun 19, 2025 pm 05:13 PM

The methods of using basic mathematical operations in PHP are as follows: 1. Addition signs support integers and floating-point numbers, and can also be used for variables. String numbers will be automatically converted but not recommended to dependencies; 2. Subtraction signs use - signs, variables are the same, and type conversion is also applicable; 3. Multiplication signs use * signs, which are suitable for numbers and similar strings; 4. Division uses / signs, which need to avoid dividing by zero, and note that the result may be floating-point numbers; 5. Taking the modulus signs can be used to judge odd and even numbers, and when processing negative numbers, the remainder signs are consistent with the dividend. The key to using these operators correctly is to ensure that the data types are clear and the boundary situation is handled well.

How can you interact with NoSQL databases (e.g., MongoDB, Redis) from PHP? How can you interact with NoSQL databases (e.g., MongoDB, Redis) from PHP? Jun 19, 2025 am 01:07 AM

Yes, PHP can interact with NoSQL databases like MongoDB and Redis through specific extensions or libraries. First, use the MongoDBPHP driver (installed through PECL or Composer) to create client instances and operate databases and collections, supporting insertion, query, aggregation and other operations; second, use the Predis library or phpredis extension to connect to Redis, perform key-value settings and acquisitions, and recommend phpredis for high-performance scenarios, while Predis is convenient for rapid deployment; both are suitable for production environments and are well-documented.

How do I stay up-to-date with the latest PHP developments and best practices? How do I stay up-to-date with the latest PHP developments and best practices? Jun 23, 2025 am 12:56 AM

TostaycurrentwithPHPdevelopmentsandbestpractices,followkeynewssourceslikePHP.netandPHPWeekly,engagewithcommunitiesonforumsandconferences,keeptoolingupdatedandgraduallyadoptnewfeatures,andreadorcontributetoopensourceprojects.First,followreliablesource

What is PHP, and why is it used for web development? What is PHP, and why is it used for web development? Jun 23, 2025 am 12:55 AM

PHPbecamepopularforwebdevelopmentduetoitseaseoflearning,seamlessintegrationwithHTML,widespreadhostingsupport,andalargeecosystemincludingframeworkslikeLaravelandCMSplatformslikeWordPress.Itexcelsinhandlingformsubmissions,managingusersessions,interacti

How to set PHP time zone? How to set PHP time zone? Jun 25, 2025 am 01:00 AM

TosettherighttimezoneinPHP,usedate_default_timezone_set()functionatthestartofyourscriptwithavalididentifiersuchas'America/New_York'.1.Usedate_default_timezone_set()beforeanydate/timefunctions.2.Alternatively,configurethephp.inifilebysettingdate.timez

See all articles