防止laravel中的sql注入 [英] prevent sql injection in laravel

问题描述

假设使用原始查询，我在laravel中有以下内容

Suppose using raw query I have the following in laravel

$a = DB::select( DB::raw("SELECT * FROM table WHERE col = '$var'") );

在这种情况下，如何保护我们的应用程序免受SQL注入攻击?

How can I protect our application from SQL injection attacks in this type of cases?

推荐答案

Illuminate \ Database \ Connection中的select()方法可以绑定我们的参数:

select() method in Illuminate\Database\Connection has a way to bind our parameters:

public function select($query, $bindings = array())
{
    ....
    ....
}

所以我们可以将绑定数组传递给select()方法

so we can pass an array of bindings to the select() method

如此

$a = DB::select( DB::raw("SELECT * FROM table WHERE col = :var") , array(
   'var' => $var,
 ));

这篇关于防止laravel中的sql注入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！