进入SQL查询之前是否需要转义$ _SESSION ['username']? [英] Does $_SESSION['username'] need to be escaped before getting into an SQL query?

问题描述

我想知道在SQL查询中使用$ _SESSION数组之前是否需要对其进行转义.

I am wondering if anything from the $_SESSION array needs to be escaped before I use it in a SQL query.

请注意，由于我听说过cookie可以用于会话劫持(?)，因此我不会在其应用程序中使用它们

Note that I don't use cookies in my application, since I've heard that they could be used for session hijacking (?)

非常感谢

推荐答案

您需要对传递给sql查询的每个字符串进行转义，无论其起源如何.

You need to escape every string you pass to the sql query, ragardless of its origin.

即使这是您从数据库中检索到的数据.

Even if it is the data you retrieved from your database.

这篇关于进入SQL查询之前是否需要转义$ _SESSION ['username']?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！