加密來自SQL注入的數據

Question

請告訴我如何正確加密從sql注入發送到服務器的數據（用戶名，電子郵件，消息）。我無法理解記錄本身的語法。

我的PHP處理程序

session_start(); 

if (isset($_SESSION['captcha']) && $_SESSION['captcha']===$_POST['captcha']){ 
    if (isset($_POST['username']) && isset($_POST['email']) && isset($_POST['message'])){ 

     $username = $_POST['username']; 
     $email = $_POST['email']; 
     $message = $_POST['message']; 

     $db_host = "localhost"; 
     $db_user = "alekspvn"; // Логин БД 
     $db_password = "123"; // Пароль БД 
     $db_table = "book"; // Имя Таблицы БД 

    $connect_db=mysql_connect(HOST, MYSQL_USER, MYSQL_PASS) 
     or die("No connection with SQL"); 

     mysql_select_db("guests_db",$connect_db); 

     mysql_query("SET NAMES 'utf8'",$connect_db); 

     $result = mysql_query ("INSERT INTO ".$db_table." (username,email,message) VALUES ('$username','$email','$message')"); 
     echo json_encode(['success' => true, 'message' => 'Added to db']); 
    } 
} 
else { 
    echo json_encode(['error' => false, 'message' => 'Wrong captcha']); 
} 

Answer 1

轉換您Username和Password到password_hash存儲

https://secure.php.net/manual/en/function.password-hash.phphttps://secure.php.net/manual/en/function.password-verify.php