使用PHP防止注入SQL [英] Prevent injection SQL with PHP

问题描述

因为我的陈述就像

"SELECT * FROM `box` WHERE `thing` = '{$variable}'

我可以简单地清理一下

$variable = str_replace("'","\'",$variable);
"SELECT * FROM `box` WHERE `thing` = '{$variable}'

那行得通吗?我的主机不支持mysql转义，并且我没有使用mysqli.

Would that work? My host doesn't support mysql escape and I'm not using mysqli.

推荐答案

根据哪种类作为查询的有效数据类型，通常可以逃脱:

Depending on what classes as a valid data type for your query, you can usually get away with:

function cleanVar($str){
    $str = strip_tags(addslashes($str));
    return $str;
}

这篇关于使用PHP防止注入SQL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！