The mysql_real_escape_string() function escapes special characters in strings used in SQL statements.
The following characters are affected:
If successful, the function returns the escaped string. If failed, returns false.
Usage is mysql_real_escape_string(string,connection)
This function escapes special characters in a string and takes into account the current character set of the connection, so it is safe to use with mysql_query(). Use this function to prevent database attacks.
<?php $con = mysql_connect("localhost", "hello", "321"); if (!$con) { die('Could not connect: ' . mysql_error()); } // 获得用户名和密码的代码 // 转义用户名和密码,以便在 SQL 中使用 $user = mysql_real_escape_string($user); $pwd = mysql_real_escape_string($pwd); $sql = "SELECT * FROM users WHERE user='" . $user . "' AND password='" . $pwd . "'" // 更多代码 mysql_close($con); ?>
Database attack. This example shows what happens if we don't apply the mysql_real_escape_string() function to the username and password:
<?php $con = mysql_connect("localhost", "hello", "321"); if (!$con) { die('Could not connect: ' . mysql_error()); } $sql = "SELECT * FROM users WHERE user='{$_POST['user']}' AND password='{$_POST['pwd']}'"; mysql_query($sql); // 不检查用户名和密码 // 可以是用户输入的任何内容,比如: $_POST['user'] = 'john'; $_POST['pwd'] = "' OR ''='"; // 一些代码... mysql_close($con); ?>
Then the SQL query will look like this:
SELECT * FROM users WHERE user='john' AND password='' OR ''=''
This means that any user can log in without entering a valid password.
<?php function check_input($value) { // 去除斜杠 if (get_magic_quotes_gpc()) { $value = stripslashes($value); } // 如果不是数字则加引号 //if (!is_numeric($value)) //{ $value = mysql_real_escape_string($value); //} return $value; } $con = mysql_connect("localhost", "hello", "321"); if (!$con) { die('Could not connect: ' . mysql_error()); } // 进行安全的 SQL $user = check_input($_POST['user']); $pwd = check_input($_POST['pwd']); $sql = "SELECT * FROM users WHERE user=$user AND password=$pwd"; mysql_query($sql); mysql_close($con); ?>
mysql_escape_string() also has a similar effect. Regarding these two functions, I remember that when I used the mysql_real_escape_string() function, the program always made errors, and I didn’t know the cause of the errors. Later, when I changed to the mysql_escape_string() function, it worked. Searching the manual, I found that when using mysql_real_escape_string(), a database connection must be established first, otherwise an error will be reported -___-|||
mysql_real_escape_string() calls MySQL's library function mysql_escape_string, which prepends backslashes to the following characters: NULL, x00, n, r, , ', " and x1a
mysql_escape_string() does not escape % and _.
This function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.
<?php // Connect $link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password') OR die(mysql_error()); // Query $query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'", mysql_real_escape_string($user), mysql_real_escape_string($password)); ?>