如何为php中的每个数据库扩展转义字符串？ [英] How are strings escaped for each database extension in php?
问题描述
在任何人对此问题的性质作出结论之前，我已经知道参数化/预备语句，并尽可能使用它们。不幸的是，在构建动态查询时并不总是可以使用它们。
Before anyone jumps to conclusions as to the nature of this question, I already know about parameterized/prepared statements and use them whenever possible. Unfortunately, it is not always possible to use them when building dynamic queries.
使用MySQL以外的数据库，但我不能轻松找到有关如何转义字符串的每个数据库扩展的好来源，以防止 SQL注入。
I'm interested in working with databases other than MySQL, but I can't easily find good sources as to how to escape strings for each database extension to prevent SQL Injection.
PHP文档列出了以下供应商特定的数据库扩展。我加粗了我最感兴趣的人：
The PHP docs list the following vendor specific database extensions. I've boldened the ones I'm most interested in:
- CUBRID
- li>
- DB ++
- FrontBase
- filePro
- Firebird / InterBase
-
- Informix
- IBM DB2
- Ingres
- MaxDB
- Mongo
- mSQL
- Mssql
- MySQL
- Mysqli
- Mysqlnd
- > mysqlnd_ qc
- OCI8
- Ovrimos SQL
- 悖论
- PostgreSQL
- SQLite
- SQLite3
- Sybase
- tokyo_ tyrant
- CUBRID
- dBase
- DB++
- FrontBase
- filePro
- Firebird/InterBase
- Informix
- IBM DB2
- Ingres
- MaxDB
- Mongo
- mSQL
- Mssql
- MySQL
- Mysqli
- Mysqlnd
- mysqlnd_ qc
- OCI8
- Ovrimos SQL
- Paradox
- PostgreSQL
- SQLite
- SQLite3
- Sybase
- tokyo_ tyrant
动态查询不适用于大多数参数化语句的示例：
Example of dynamic query that wont work for most parameterized statements:
"Select $col1, $col2 from $table where $col1 = ?"
$ col1 后， $ col2 和 $ table 已被转义，该语句可用于预编译语句。
After $col1, $col2, and $table have been escaped, the statement can be used in a prepared statement.
推荐答案
MySQLi
使用 mysqli_real_escape_string 。
这篇关于如何为php中的每个数据库扩展转义字符串？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
