如何使這個插入從MySQL注入安全？

Question

我是PHP和數據庫編程的新手，一直在嘗試將表單中的數據添加到MySQL數據庫中。它工作正常，但是這對我的MySQL注入是開放的嗎？我讀過很多教程，我在想PDO準備好的語句。例如，我如何爲我的評論欄做到這一點？這個字段（它是一個文本字段）對於用戶想要放置的任何內容都是相當開放的。我怎麼寫這個以使它更安全？

<?php 
ob_start(); 
$username = 'name'; 
$password = 'pass'; 
$host = 'localhost'; 
$dbname = 'map'; 



try { 
$dbh = new PDO("mysql:host=$host;dbname=$dbname", $username, $password); 
// set the PDO error mode to exception 
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
$sql = "INSERT INTO Incidents (


     protocol, 
     jurisdiction, 
     date, 
     time, 
     comments, 
     video, 
     lat, 
     lng 



      ) 

     VALUES (


     '".$_POST["protocol"]."', 
     '".$_POST["jurisdiction"]."', 
     '".$_POST["date"]."', 
     '".$_POST["time"]."', 
     '".$_POST["comments"]."', 
     '".$_POST["video"]."', 
     '".$_POST["lat"]."', 
     '".$_POST["lng"]."' 


     ) 

     "; 

// use exec() because no results are returned 
$dbh->exec($sql); 
header("Location: map1.php"); 

} 
catch(PDOException $e) 
{ 
echo $sql . "<br>" . $e->getMessage(); 
} 

$dbh = null; 




ob_end_flush(); 
?> 

Answer 1

PDO已經非常安全。現在你可以使用bindParam()增加，如安全：

<?php 
ob_start(); 
$username = 'name'; 
$password = 'pass'; 
$host = 'localhost'; 
$dbname = 'map'; 

try { 
$dbh = new PDO("mysql:host=$host;dbname=$dbname", $username, $password); 
// set the PDO error mode to exception 
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

$sql = "INSERT INTO Incidents SET protocol = ?, jurisdiction = ?, date = ?, time = ?, comments = ?, video = ?, lat = ?, lng = ? "; 
$smt->$dbh->prepare($sql); 
$smt->bindParam(1, $_POST["protocol"]); 
$smt->bindParam(2, $_POST["jurisdiction"]); 
$smt->bindParam(3, $_POST["date"]); 
$smt->bindParam(4, $_POST["time"]); 
$smt->bindParam(5, $_POST["comments"]); 
$smt->bindParam(6, $_POST["video"]); 
$smt->bindParam(7, $_POST["lat"]); 
$smt->bindParam(8, $_POST["lng"]); 

// use exec() because no results are returned 
$smt->execute(); 
if($smt->rowCount()) { // if insertion success 
    header("Location: map1.php"); 
} 

} 
catch(PDOException $e) { 
    echo $sql . "<br>" . $e->getMessage(); 
} 

$dbh = null; 

ob_end_flush(); 
?> 

Answer 2

您已經使用PDO，這是非常好的。

但是，您還應該使用準備好的語句女巫應該是SQL注入證明。檢查此鏈接瞭解更多信息：http://php.net/manual/en/pdo.prepared-statements.php

從文檔的插入例如：

$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)"); 
$stmt->bindParam(':name', $name); 
$stmt->bindParam(':value', $value); 

// insert one row 
$name = 'one'; 
$value = 1; 
$stmt->execute(); 

Answer 3

您應該使用準備語句。

好吧，這樣做：

new PDO("mysql:host=$host;dbname=$dbname", $username, $password); 

$sql = 'SELECT name, colour, calories 
    FROM fruit 
    WHERE calories < :calories AND colour = :colour'; 

$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY)); 

$sth->execute(array(':calories' => $variable, ':colour' => $color)); 

$red = $sth->fetchAll(); 

$sth->execute(array(':calories' => 175, ':colour' => 'yellow')); 

$yellow = $sth->fetchAll(); 

例最初是從php.net採取

你可以閱讀更多關於它，在這裏：http://php.net/manual/en/pdo.prepare.php

Answer 4

1) Use PDO 
2) Escape all the special characters 
3) Use parameterized queries 

請參閱本How can I prevent SQL injection in PHP?