mysqli_real_escape_string如何无法阻止SQL注入? [英] How can mysqli_real_escape_string fail to prevent a SQL injection?

问题描述

首先，我得到人们希望使用存储过程，以便他们重用查询并处理转义.但是，我读过很多开发人员说mysqli_real_escape_string不能100％防止SQL注入.有人可以提供一个例子吗?

First of all, I get that people want to use stored procedures so that they reuse queries and have the escaping taken care of. However, I have read many developers say that mysqli_real_escape_string can not 100% prevent SQL injections. Can someone please provide an example of this?

根据我对此问题的有限了解，我会说mysqli_real_escape_string总是 对于字符串来说很好，但是对于数字值，除非您检查数字是否为int，float，加倍，等等.

From my limited knowledge on the subject I would say that mysqli_real_escape_string would always be fine for strings but for numerical values you could be caught out unless you check the number is an int, float, double, etc.

我忘了添加一些重要的内容:假定字符集为UTF8，并且已经相应地调用了mysqli_set_charset.我见过的唯一注入依赖于少数几个字符集(都不是UTF8).

I forgot to add something critical: assume that the charset is UTF8 and mysqli_set_charset has been called accordingly. The only injecting I've seen rely a handful of charsets (none of which are UTF8).

推荐答案

只要您使用mysqli_set_charset()设置客户端编码，并且mysqli_real_escape_string()仅用于格式化字符串，它就会非常安全.

As long as you are using mysqli_set_charset() to set client encoding, and mysqli_real_escape_string() is used to format strings only, it is perfectly safe.

但是，如果您的问题暗示要在应用程序代码中正确使用此功能，则不要在幕后处理基于占位符的查询，或者至少采用PDO的quote()类功能的形式(该功能可以转义和一次引用)，这是直接注入的方式.

However, if your question implied using this function right in the application code, instead of behind-the-scenes processing of placeholder-based query or at least in the form of PDO's quote()-like function (which does escaping and quoting at once) it is straight way to injection.

功能本身并不是问题，而是其使用方式:

It is not function itself being a problem, but the way it is used:

• 因为它仅执行所需格式的 part 部分，所以您很容易忘记另一部分并陷入麻烦
• 或者甚至很容易被误用，它不是格式化字符串，而是格式化另一个完全不会从转义中受益的文字.
• 第二，在应用程序代码中正确使用它时，用法会变得不一致或偶发，因为无法强迫开发人员正确格式化每个文字，并且不会失败.这又可能导致不准确和注入.

• as it does only part of required formatting, one can easily forget another part and slip into trouble
• or even it can be easily misused, to format not a string but another literal which will no benefit from escaping at all.
• second, when it's used right in the application code, it is usage become inconsistent or occasional, as there is no way to force a developer to format every literal properly and without fail. This again may lead to inaccuracy and injection.

这就是为什么您必须始终使用占位符来表示查询中的数据的原因(而mysqli_real_escape_string可以用于处理该占位符)

That's why you have to always use a placeholder to represent data in the query (while mysqli_real_escape_string can be used to process this placeholder all right)

这篇关于mysqli_real_escape_string如何无法阻止SQL注入?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！