如何避免在sql注入在codeigniter [英] how to avoid sql injection in codeigniter
问题描述
在CodeIgniter中,我如何避免sql注入?有没有任何方法在配置文件中设置避免sql注入?我使用此代码选择值:
$ this-> db-> query(SELECT * FROM tablename WHERE var ='$ val1');
,用于插入值:
$ this-> db-> query(INSERT INTO tablename(`var1`,`var2`)VALUES('$ val1','$ val2'));
另一种用于从数据库插入和选择值的方法是CodeIgniter的 insert )
和 get()
方法。使用CodeIgniter的bulit-in函数时是否有任何机会注入
CodeIgniter的 Active Record 方法会为您自动转义查询,以防止注入。
$ this-> db-> select('*') - > from('tablename') - > where('var',$ val1);
$ this-> db-> get();
或
$ this-> insert('tablename',array('var1'=> $ val1,'var2'=> $ val2)
如果不想使用Active Records,可以使用查询绑定以防止注入。
$ sql ='SELECT * FROM tablename WHERE var =?';
$ this-> db-> query($ sql,array($ val1));
或者,您可以使用 insert_string()
方法。
$ sql = $ this-> db-> insert_string('tablename',array('var1'=> $ val1,'var2'=> $ val2)
$ this-> db-> query($ sql);
还有
<$>
$ val1 = $ this-> db-> escape($ val1);
$ this-> db-> query(SELECT * FROM tablename WHERE var = $ val1);
In CodeIgniter, how can I avoid sql injection? Is there any method to set in config file to avoid sql injection? I am using this code for selecting values:
$this->db->query("SELECT * FROM tablename WHERE var='$val1'");
and this for inserting values:
$this->db->query("INSERT INTO tablename (`var1`,`var2`) VALUES ('$val1','$val2')");
Another method used to insert and select values from the database is CodeIgniter's insert()
and get()
methods. Is any chance to sql injection while using CodeIgniter's bulit-in functions
CodeIgniter's Active Record methods automatically escape queries for you, to prevent injection.
$this->db->select('*')->from('tablename')->where('var', $val1);
$this->db->get();
or
$this->insert('tablename', array('var1'=>$val1, 'var2'=>$val2));
If you don't want to use Active Records, you can use query bindings to prevent against injection.
$sql = 'SELECT * FROM tablename WHERE var = ?';
$this->db->query($sql, array($val1));
Or for inserting you can use the insert_string()
method.
$sql = $this->db->insert_string('tablename', array('var1'=>$val1, 'var2'=>$val2));
$this->db->query($sql);
There is also the escape()
method, if you prefer to run your own queries.
$val1 = $this->db->escape($val1);
$this->db->query("SELECT * FROM tablename WHERE var=$val1");
这篇关于如何避免在sql注入在codeigniter的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!