SQL注入插入

Question

可能重複：
Best way to prevent SQL injection?

我無法理解如何消毒PHP對SQL注入，並希望有人會好心地給我解釋一下爲了使我的代碼安全，我需要在這裏更改什麼？

<?php 
$dbConnection = mysqli_connect('****', '****', '****', 'db'); 

$query = "INSERT INTO `table` (`1`, `2`, `3`) VALUES ('$_POST[1]', '$_POST[2]', '$_POST[3]')"; 

if (mysqli_query($dbConnection, $query)) { 
echo "Successfully inserted " . mysqli_affected_rows($dbConnection) . " row"; 
} else { 
echo "Error occurred: " . mysqli_error($dbConnection); 
} 
?> 

Answer 1

的MySQLi支持prepared statements，這比手動逃逸更好：

由於您使用的程序庫MySQLi，這裏有一個例子：

/* create a prepared statement */ 
if ($stmt = mysqli_prepare($dbConnection, "INSERT INTO `table` (`1`, `2`, `3`) VALUES (?, ?, ?)")) 
{ 

    /* bind parameters for markers */ 
    mysqli_stmt_bind_param($stmt, "sss", $_POST[1], $_POST[2], $_POST[3]); 

    /* execute query */ 
    if(mysqli_stmt_execute($stmt)) 
    { 
     echo "Successfully inserted " . mysqli_affected_rows($dbConnection) . " row"; 
    } 
    else 
    { 
     echo "Error occurred: " . mysqli_error($dbConnection); 
    } 

    /* close statement */ 
    mysqli_stmt_close($stmt); 
} 

Answer 2

如果你想使用舊mysql_ *功能，以保持看http://php.net/manual/en/function.mysql-real-escape-string.php

$datapoint1 = mysql_real_escape_string($_POST[1]); 
... 
$query = "INSERT INTO `table` (`1`, `2`, `3`) VALUES ('$datapoint1', '$datapoint2', '$datapoint3')"; 

Answer 3

您可以使用準備好的語句或mysqli_real_escape_string

Answer 4

爲了防止SQL注入，您可以使用準備好的語句。你需要一些更mysqli_功能爲：

• mysqli_prepare()
• mysqli_stmt_bind_param()
• mysqli_stmt_execute()

有了這些，你可以寫類似以下內容：

$dbConnection = mysqli_connect('****', '****', '****', 'db'); 

// prepare the query 
$query = mysqli_prepare($dbConnection, "INSERT INTO `table` (`1`, `2`, `3`) VALUES (?, ?, ?)"; 

// bind parameters; 2nd parameter is for data-types 
mysqli_stmt_bind_param($query, "sss", $_POST[1], $_POST[2], $_POST[3]); 

// execute query 
if (mysqli_stmt_execute($query)) { 
    echo "Successfully inserted " . mysqli_affected_rows($dbConnection) . " row"; 
} else { 
    echo "Error occurred: " . mysqli_error($dbConnection); 
}