搜索

+

95

-

回答

1、手动转义

<?php
// PDO, "manual" escaping
$username = PDO::quote($_GET['username']);

$pdo->query("SELECT * FROM users WHERE username = $username");

// mysqli, "manual" escaping
$username = mysqli_real_escape_string($_GET['username']);

$mysqli->query("SELECT * FROM users WHERE username = '$username'");

上面采用了PDO和MySQLi的API自带的函数对获取到的参数的值进行了转义。

2、prepared statement参数绑定

下面推荐更加高效安全的prepared statement参数绑定的方式：

<?php
// PDO, prepared statement
$pdo->prepare('SELECT * FROM users WHERE username = :username');
$pdo->execute(array(':username' => $_GET['username']));

// mysqli, prepared statements
$query = $mysqli->prepare('SELECT * FROM users WHERE username = ?');
$query->bind_param('s', $_GET['username']);
$query->execute();

网友回复

我知道答案，我要回答

我有问题

最新提问