PHP 中的 mysqli 类是否可以 100% 保护 sql 注入? [英] Does mysqli class in PHP protect 100% against sql injections?

问题描述

我看过很多关于 mysqli 的文章和问题，他们都声称它可以防止 sql 注入.但它是万无一失的，还是有办法绕过它.我对跨站脚本或网络钓鱼攻击不感兴趣，只对 sql 注入感兴趣.

I've seen lots of articles and questions about mysqli, and all of them claim that it protects against sql injections. But is it fool proof, or is there still some way to get around it. I'm not interested in cross site scripting or phishing attacks, only sql injections.

我应该首先说的是我使用的是准备好的语句.这就是我对 mysqli 的意思.如果我使用没有任何字符串连接的准备好的语句，那么它是万无一失的吗?

What I should have said to begin with is that I am using prepared statements. That is what I meant with mysqli. If I use prepared statements without any string concatenation, then is it foolproof?

推荐答案

但它是万无一失的，还是有办法绕过它.

But is it fool proof, or is there still some way to get around it.

不，你必须知道你在做什么.如果您使用绑定参数(MySqli 附带的一项功能)，您就可以完全避免注入类型的攻击来自这个攻击向量.这不会阻止您 - 程序员 - 直接嵌入字符串，从而启用注入攻击.您必须按预期使用该功能.

No, you have to know what you're doing. If you use bound parameters (A feature that MySqli comes with), you are completely safe from injection type attacks from this attack vector. This doesn't prevent you - the programmer - from embedding strings directly, and thereby enabling injection attacks. You have to use the feature as intended.

我应该首先说的是我使用的是准备好的语句.这就是我对 mysqli 的意思.如果我使用没有任何字符串连接的准备好的语句，那么它是万无一失的吗?

What I should have said to begin with is that I am using prepared statements. That is what I meant with mysqli. If I use prepared statements without any string concatenation, then is it foolproof?

万无一失仍然是一个如此危险的词.但是对于通过准备好的语句绑定的变量，您可以避免注入攻击.这是因为绑定参数与 SQL 查询分开传输.与传统"嵌入字符串方法，数据库服务器需要解析输入，其中有很多边缘情况(字符集等).当数据和查询分开发送时，没有实际的解析进行(至少没有解析变量数据).

Foolproof is still such a dangerous word. But you are safe from injection attacks for the variables that are bound through prepared statements. This is because bound parameters are transmitted separately from the SQL query. With the "traditional" embed-string approach, the database server needs to parse the input and there are lots of edge cases in that (Charsets etc.). When the data and the query are sent separate, there is no actual parsing going on (At least not parsing of the variable data).

这篇关于PHP 中的 mysqli 类是否可以 100% 保护 sql 注入?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！