MySQL-Sicherheitstests-PHP开发-php.cn

Heim

php教程

PHP开发

MySQL-Sicherheitstests

Nov 19, 2016 pm 04:08 PM

mysql

一、没有进行预处理的SQL语句

&lt;?php
    
    // 1.连接数据库
  $conn = mysql_connect(&#39;127.0.0.1:3306&#39;, &#39;root&#39;, &#39;518666&#39;);
  if (!$conn)
  {
    die(&quot;Could not connect:&quot; . mysql_error());
  }

  // 2.选择数据库
  mysql_select_db(&#39;mysql_safe&#39;, $conn);


  // 3.设置编码,注意这里是utf8而不是utf-8,如果写后者，MySQL不会识别的，会出现乱码的。
  mysql_query(&quot;SET NAMES utf8&quot;);

  $title    = &quot;我们的爱情&quot;;
  $content  = &#39;你是/谁啊，大几\都&quot;老梁&quot;做做&amp;&gt;women&lt;a&gt;没&#39;;
  $add_time = date(&quot;Y-m-d H:i:s&quot;);

  // 转义字符
  $content = mysql_real_escape_string($content);
  $content = htmlspecialchars($content, ENT_COMPAT);
  // 你是/谁啊，大几都做做&amp;amp;&amp;gt;women&amp;lt;a&amp;gt;没   // 自动过滤反斜杠
/*
  // 4.插入一条数据
  $insert_sql = &quot;insert into post_tbl (title, content, user_id, add_time) values (&#39;{$title}&#39;, &#39;{$content}&#39;, &#39;4742551&#39;, &#39;{$add_time}&#39;)&quot;;
 if(mysql_query($insert_sql))
  {
    echo &#39;ok&#39;;

  }
  else
  {
    echo &quot;Error : &quot; . mysql_error();
  }
   $ret = mysql_affected_rows();
  print_r($ret);
  */
   // 5.PDO预处理插入
   // PDO（PHP Data Object）则是提供了一个 Abstraction Layer 来操作数据库
    // 查询
    $user_id  = 174742;
    $password = &quot;&#39;&#39;or &#39;1=1&#39;&quot; ;
    $sql = &quot;select * from post_tbl where user_id = {$user_id} and password = {$password}&quot;;

    print_r($sql);
    $query  = mysql_query($sql);
    // $result = mysql_fetch_array($query);

    $rows = array();
    while($row=mysql_fetch_array($query))
    {
         $rows[] = $row;
    }

   
    print_r( $rows);




  // 关闭数据库连接
  mysql_close($conn);

/*

$str = &quot;Bill &amp; &#39;Steve&#39;&quot;;
echo htmlspecialchars($str, ENT_COMPAT); // 只转换双引号
echo &quot;&lt;br&gt;&quot;;
echo htmlspecialchars($str, ENT_QUOTES); // 转换双引号和单引号
echo &quot;&lt;br&gt;&quot;;
echo htmlspecialchars($str, ENT_NOQUOTES); // 不转换任何引号
*/

/*
以上代码的 HTML 输出如下（查看源代码）：
&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;body&gt;
Bill &amp;amp; &#39;Steve&#39;&lt;br&gt;
Bill &amp;amp; &amp;#039;Steve&amp;#039;&lt;br&gt;
Bill &amp;amp; &#39;Steve&#39;
&lt;/body&gt;
&lt;/html&gt;
以上代码的浏览器输出：
Bill &amp; &#39;Steve&#39;
Bill &amp; &#39;Steve&#39;
Bill &amp; &#39;Steve&#39;
*/

  function mforum_html_tag_to_html_entity($content)
{
  $content = (string)trim($content);
  if(empty($content)) return &#39;&#39;;
  // $content = str_replace(&#39;&amp;nbsp;&#39;, &#39; &#39;, $content);
  $content = htmlspecialchars($content, ENT_COMPAT, GB2312, false);
  $content = str_replace(&quot;&amp;gt;&quot;, &quot;&amp;#62;&quot;, $content);
  $content = str_replace(&quot;&amp;lt;&quot;, &quot;&amp;#60;&quot;, $content);
  $content = str_replace(&quot;\&quot;&quot;, &quot;&amp;quot;&quot;, $content);
  $content = preg_replace(&quot;/\\\$/&quot;, &quot;&amp;#036;&quot;, $content);
  $content = preg_replace(&quot;/\r/&quot;, &quot;&quot;, $content);
  $content = str_replace(&quot;!&quot;, &quot;&amp;#33;&quot;, $content);
  $content = str_replace(&quot;&#39;&quot;, &quot;&amp;#39;&quot;, $content);
  $content = preg_replace(&quot;/\\\/&quot;, &quot;&amp;#092;&quot;, $content);

  // 内容敏感词过滤
  return $content;
}

Nach dem Login kopieren

二、PDO处理的SQL语句

&lt;?php  

// PDO的使用
// http://blog.csdn.net/qq635785620/article/details/11284591
$dbh = new PDO(&#39;mysql:host=127.0.0.1:3306;dbname=mysql_safe&#39;, &#39;root&#39;, &#39;518666&#39;); 
 
$dbh-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);    
$dbh-&gt;exec(&#39;set names utf8&#39;);   

$title    = &quot;我们的爱情&quot;;
$content  = &#39;你是/谁啊，大几\都&quot;老梁&quot;做做&amp;&gt;women&lt;a&gt;没&#39; . &quot; 测试打印号&#39;我是单引号&#39;哈哈&quot;;
$user_id  = 174742;
$add_time = date(&quot;Y-m-d H:i:s&quot;);

// $insert_sql = &quot;insert into post_tbl (title, content, user_id, add_time) values (:x_title, :x_content, :x_user_id, :x_add_time)&quot;;

// $stmt = $dbh-&gt;prepare($insert_sql); 
// $stmt-&gt;execute(array(&#39;x_title&#39;=&gt;$title,&#39;:x_content&#39;=&gt; $content, &#39;:x_user_id&#39; =&gt; $user_id, &#39;:x_add_time&#39; =&gt; $add_time));    

// 查询
$user_id  = &quot;17474#&quot;;
// $password = &quot;&#39;&#39;or &#39;1=1&#39;&quot;;
 $password = 123456;
$sql = &#39;select * from post_tbl where user_id = :x_user_id and password = :x_password&#39;;
$stmt = $dbh-&gt;prepare($sql);    
$stmt-&gt;execute(array(&#39;:x_user_id&#39;=&gt;$user_id, &#39;:x_password&#39; =&gt; $password));    

$rows = array();
while($row = $stmt-&gt;fetch(PDO::FETCH_ASSOC))
{   
   $rows[] = $row;    
    
}   
print_r($rows);    

// echo $dbh-&gt;lastinsertid();

Nach dem Login kopieren

Erklärung dieser Website

Der Inhalt dieses Artikels wird freiwillig von Internetnutzern beigesteuert und das Urheberrecht liegt beim ursprünglichen Autor. Diese Website übernimmt keine entsprechende rechtliche Verantwortung. Wenn Sie Inhalte finden, bei denen der Verdacht eines Plagiats oder einer Rechtsverletzung besteht, wenden Sie sich bitte an admin@php.cn