PHP＆SQL：從SQL注入保護此查詢的最佳方法不使用PDO

Question

我有一個針對mssql數據庫運行的查詢，我沒有使用PDO驅動程序。有沒有像我可以使用的準備好的聲明？

下面是該查詢：

$tsql = "INSERT INTO cplinktable (liferayid, bmsid, autotaskid, waspdb, cpid) VALUES ($liferayid, $bmsid, $autotaskid, '$waspdb', $cpid)"; 

感謝，

Jonesy

Answer 1

微軟SQL驅動程序PHP提供預處理語句：

• http://www.microsoft.com/downloads/en/details.aspx?FamilyID=80e44913-24b4-4113-8807-caae6cf2ca05&displaylang=en
• http://msdn.microsoft.com/en-US/library/cc296184%28v=SQL.90%29.aspx

Answer 2

你至少應該逃避值。

PHP Manual - mysql_real_escape_string

Answer 3

嘗試用sprint()

$tsql = "INSERT INTO cplinktable (liferayid, bmsid, autotaskid, waspdb, cpid) VALUES (%d, %d, %d, '%s', %d)"; 

$tsql = sprintf($tsql, $liferayid, $bmsid, $autotaskid, $waspdb, $cpid); 
echo $tsql; // you would execute this but printing to the screen to show the query 

Answer 4

$query = sprintf("INSERT INTO cplinktable (liferayid, bmsid, autotaskid, waspdb, cpid) VALUES ('%s','%s','%s','%s','%s')", 
      mysql_real_escape_string($liferavid), 
      mysql_real_escape_string($bmsid), 
      mysql_real_escape_string($autotaskid), 
      mysql_real_escape_string($waspdb), 
      mysql_real_escape_string($cpid)); 

Answer 5

準備語句，它的那麼簡單，對數字/整數字符串和類型轉換期運用mysql_real_escape /雙打

(int)$number; //Safe 
(double)$double; //Safe 
mysql_real_escape_string($string); //Safe 

這用在您插入y的每一條數據我們的數據庫是安全