Protection against SQL injection

 

This question already has an answer here:

  • How can I prevent SQL injection in PHP? 28 answers

    • You may want to look into parameterized queries for querying the database. This eliminates SQL injection attacks.

    I work primarily with postgreSQL, and the format for doing such a query would look something like this: 

    $query = 'select * from Benutzer where Benutzername = $1 and Passwort = $2';
$params = array($Benutzer, md5($PW));
$results = pg_query_params($query, $params);

    Most databases have a function that will be similar to this funationality.

    I hope this helps and good luck!

    Kyle

    I'd personally advise using an algorithm such as SHA1 over MD5, as there is a lower possibility of collisions. You should be salting your passwords too, otherwise one can use rainbow tables to crack your passwords.

    Also, use mysql_real_escape_string() to escape things, don't simply do a search and replace for common injections.

    Prepared statements are a fantastic invention.

    http://www.php.net/manual/en/pdo.prepare.php and http://www.php.net/manual/en/mysqli.prepare.php for examples.

    链接地址: http://www.djcxy.com/p/16738.html

    上一篇: 逃脱字符串的最佳使用和实践

    下一篇: 防止SQL注入