PHP保护数据库的具体代码示例
php
잃어버린
~을 위한
암호
예
보호하다
특정한
~로 이어지다
가져오다
데이터
데이터 베이스
~의
예
관리하다
소유하다
因为数据库管理不善导致数据丢失，为自己带来损失的例子不再少数。我们这次就要讲到下面代码显示了运行 SQL 语句的示例脚本。在本例中，SQL 语句是允许相同攻击的动态语句。此表单的所有者可能认为表单是安全的，因为他们已经把列名限定为选择列表。但是，代码疏忽了关于表单欺骗的最后一个习惯 — 代码将选项限定为下拉框并不意味着其他人不能够发布含有所需内容的表单（包括星号 [*]）。
<ol class="dp-xml">
<li class="alt"><span><strong><font color="#006699"><span class="tag"><span class="tag-name">html</span><span class="tag">></span></span></font></strong><span> </span></span></li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">head</span><span class="tag">></span></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">title</span><span class="tag">></span></span></font></strong><span>SQL Injection Example</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">title</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">head</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">body</span><span class="tag">></span></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">form</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">id</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"myFrom"</font></span><span> </span><span class="attribute"><font color="#ff0000">action</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"<?php echo $_SERVER['PHP_SELF']; ?>"</font></span><span> </span>
</li>
<li class="alt">
<span> </span><span class="attribute"><font color="#ff0000">method</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"post"</font></span><span class="tag"><strong><font color="#006699">></font></strong></span><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">div</span><span class="tag">></span><span class="tag"><span class="tag-name">input</span></span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">type</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"text"</font></span><span> </span><span class="attribute"><font color="#ff0000">name</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"account_number"</font></span><span> </span>
</li>
<li class="alt">
<span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>="</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">php</span></font></strong><span> echo(isset($_POST['account_number']) ? </span>
</li>
<li class="">
<span> $_POST['account_number'] : ''); </span><span class="tag"><strong><font color="#006699">?></font></strong></span><span>" </span><span class="tag"><strong><font color="#006699">/></font></strong></span><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">select</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">name</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"col"</font></span><span class="tag"><strong><font color="#006699">></font></strong></span><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">option</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"account_number"</font></span><span class="tag"><strong><font color="#006699">></font></strong></span><span>Account Number</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">option</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">option</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"name"</font></span><span class="tag"><strong><font color="#006699">></font></strong></span><span>Name</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">option</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">option</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"address"</font></span><span class="tag"><strong><font color="#006699">></font></strong></span><span>Address</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">option</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">select</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">input</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">type</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"submit"</font></span><span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"Save"</font></span><span> </span><span class="attribute"><font color="#ff0000">name</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"submit"</font></span><span> </span><strong><font color="#006699"><span class="tag">/></span><span class="tag"></span><span class="tag-name">div</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">form</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">php</span></font></strong><span> </span>
</li>
<li class="alt"><span>if ($_POST['submit'] == 'Save') { </span></li>
<li class=""><span> /* do the form processing */ </span></li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">link</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">mysql_connect</font></span><span>('hostname', 'user', 'password') or </span>
</li>
<li class=""><span> die ('Could not connect' . mysql_error()); </span></li>
<li class="alt"><span> mysql_select_db('test', $link); </span></li>
<li class=""><span> </span></li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">col</font></span><span> = $_POST['col']; </span>
</li>
<li class=""><span> </span></li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">select</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">"SELECT "</font></span><span> . $col . " FROM account_data WHERE </span><span class="attribute"><font color="#ff0000">account_number</font></span><span> = " </span>
</li>
<li class=""><span> . $_POST['account_number'] . ";" ; </span></li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">p</span><span class="tag">></span></span></font></strong><span>' . $select . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">p</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class=""><span> </span></li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">result</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">mysql_query</font></span><span>($select) or die('</span><strong><font color="#006699"><span class="tag"><span class="tag-name">p</span><span class="tag">></span></span></font></strong><span>' . mysql_error() . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">p</span><span class="tag">></span></font></strong><span>'); </span>
</li>
<li class=""><span> </span></li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">table</span><span class="tag">></span></span></font></strong><span>'; </span>
</li>
<li class="">
<span> while ($</span><span class="attribute"><font color="#ff0000">row</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">mysql_fetch_assoc</font></span><span>($result)) { </span>
</li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">tr</span><span class="tag">></span></span></font></strong><span>'; </span>
</li>
<li class="">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">td</span><span class="tag">></span></span></font></strong><span>' . $row[$col] . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">td</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">tr</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class=""><span> } </span></li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">table</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class=""><span> </span></li>
<li class="alt"><span> mysql_close($link); </span></li>
<li class=""><span>} </span></li>
<li class="alt">
<span></span><span class="tag"><strong><font color="#006699">?></font></strong></span><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">body</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">html</span><span class="tag">></span></font></strong><span> </span>
</li>
</ol>로그인 후 복사
因此，要形成PHP保护数据库的习惯，请尽可能避免使用动态 SQL 代码。如果无法避免动态 SQL 代码，请不要对列直接使用输入。下面则显示了除使用静态列外，还可以向帐户编号字段添加简单验证例程以确保输入值不是非数字值。
<ol class="dp-xml">
<li class="alt"><span><strong><font color="#006699"><span class="tag"><span class="tag-name">html</span><span class="tag">></span></span></font></strong><span> </span></span></li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">head</span><span class="tag">></span></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">title</span><span class="tag">></span></span></font></strong><span>SQL Injection Example</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">title</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">head</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">body</span><span class="tag">></span></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">form</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">id</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"myFrom"</font></span><span> </span><span class="attribute"><font color="#ff0000">action</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"<?php echo $_SERVER['PHP_SELF']; ?>"</font></span><span> </span>
</li>
<li class="alt">
<span> </span><span class="attribute"><font color="#ff0000">method</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"post"</font></span><span class="tag"><strong><font color="#006699">></font></strong></span><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"><span class="tag-name">div</span><span class="tag">></span><span class="tag"><span class="tag-name">input</span></span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">type</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"text"</font></span><span> </span><span class="attribute"><font color="#ff0000">name</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"account_number"</font></span><span> </span>
</li>
<li class="alt">
<span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>="</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">php</span></font></strong><span> echo(isset($_POST['account_number']) ? </span>
</li>
<li class="">
<span> $_POST['account_number'] : ''); </span><span class="tag"><strong><font color="#006699">?></font></strong></span><span>" </span><span class="tag"><strong><font color="#006699">/></font></strong></span><span> </span><strong><font color="#006699"><span class="tag"><span class="tag-name">input</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">type</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"submit"</font></span><span> </span>
</li>
<li class="alt">
<span> </span><span class="attribute"><font color="#ff0000">value</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"Save"</font></span><span> </span><span class="attribute"><font color="#ff0000">name</font></span><span>=</span><span class="attribute-value"><font color="#0000ff">"submit"</font></span><span> </span><strong><font color="#006699"><span class="tag">/></span><span class="tag"></span><span class="tag-name">div</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">form</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">php</span></font></strong><span> </span>
</li>
<li class=""><span>function isValidAccountNumber($number) </span></li>
<li class="alt"><span>{ </span></li>
<li class=""><span> return is_numeric($number); </span></li>
<li class="alt"><span>} </span></li>
<li class=""><span>if ($_POST['submit'] == 'Save') { </span></li>
<li class="alt"><span> </span></li>
<li class=""><span> /* Remember habit #1--validate your data! */ </span></li>
<li class="alt"><span> if (isset($_POST['account_number']) & </span></li>
<li class=""><span> isValidAccountNumber($_POST['account_number'])) { </span></li>
<li class="alt"><span> </span></li>
<li class=""><span> /* do the form processing */ </span></li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">link</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">mysql_connect</font></span><span>('hostname', 'user', 'password') or </span>
</li>
<li class=""><span> die ('Could not connect' . mysql_error()); </span></li>
<li class="alt"><span> mysql_select_db('test', $link); </span></li>
<li class=""><span> </span></li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">select</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">sprintf</font></span><span>("SELECT account_number, name, address " . </span>
</li>
<li class="">
<span> " FROM account_data WHERE </span><span class="attribute"><font color="#ff0000">account_number</font></span><span> = %s;", </span>
</li>
<li class="alt"><span> mysql_real_escape_string($_POST['account_number'])); </span></li>
<li class="">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">p</span><span class="tag">></span></span></font></strong><span>' . $select . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">p</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class="alt">
<span> $</span><span class="attribute"><font color="#ff0000">result</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">mysql_query</font></span><span>($select) or die('</span><strong><font color="#006699"><span class="tag"><span class="tag-name">p</span><span class="tag">></span></span></font></strong><span>' . mysql_error() . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">p</span><span class="tag">></span></font></strong><span>'); </span>
</li>
<li class=""><span> </span></li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">table</span><span class="tag">></span></span></font></strong><span>'; </span>
</li>
<li class="">
<span> while ($</span><span class="attribute"><font color="#ff0000">row</font></span><span> = </span><span class="attribute-value"><font color="#0000ff">mysql_fetch_assoc</font></span><span>($result)) { </span>
</li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">tr</span><span class="tag">></span></span></font></strong><span>'; </span>
</li>
<li class="">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">td</span><span class="tag">></span></span></font></strong><span>' . $row['account_number'] . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">td</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">td</span><span class="tag">></span></span></font></strong><span>' . $row['name'] . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">td</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class="">
<span> echo '</span><strong><font color="#006699"><span class="tag"><span class="tag-name">td</span><span class="tag">></span></span></font></strong><span>' . $row['address'] . '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">td</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">tr</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class=""><span> } </span></li>
<li class="alt">
<span> echo '</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">table</span><span class="tag">></span></font></strong><span>'; </span>
</li>
<li class=""><span> </span></li>
<li class="alt"><span> mysql_close($link); </span></li>
<li class=""><span> } else { </span></li>
<li class="alt">
<span> echo "</span><strong><font color="#006699"><span class="tag"><span class="tag-name">span</span></span></font></strong><span> </span><span class="attribute"><font color="#ff0000">style</font></span><span>="font-color:red"</span><span class="tag"><strong><font color="#006699">></font></strong></span><span>" . </span>
</li>
<li class="">
<span> "Please supply a valid account number!</span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">span</span><span class="tag">></span></font></strong><span>"; </span>
</li>
<li class="alt"><span> </span></li>
<li class=""><span> } </span></li>
<li class="alt"><span>} </span></li>
<li class="">
<span></span><span class="tag"><strong><font color="#006699">?></font></strong></span><span> </span>
</li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">body</span><span class="tag">></span></font></strong><span> </span>
</li>
<li class="">
<span></span><strong><font color="#006699"><span class="tag"></span><span class="tag-name">html</span><span class="tag">></span></font></strong><span> </span>
</li>
</ol>로그인 후 복사
在这次PHP保护数据库的例子中还展示了 mysql_real_escape_string() 函数的用法。此函数将正确地过滤您的输入，因此它不包括无效字符。如果您一直依赖于 magic_quotes_gpc，那么需要注意它已被弃用并且将在 PHP V6 中删除。从现在开始应避免使用它并在此情况下编写安全的 PHP 应用程序。此外，如果使用的是 ISP，则有可能您的 ISP 没有启用 magic_quotes_gpc。
最后，在改进的PHP保护数据库示例中，您可以看到该 SQL 语句和输出没有包括动态列选项。使用这种方法，如果把列添加到稍后含有不同信息的表中，则可以输出这些列。如果要使用框架以与数据库结合使用，则您的框架可能已经为您执行了 SQL 验证。确保查阅文档以保证框架的安全性；如果仍然不确定，请进行验证以确保稳妥。即使使用框架进行数据库交互，仍然需要执行其他验证。
본 웹사이트의 성명
본 글의 내용은 네티즌들의 자발적인 기여로 작성되었으며, 저작권은 원저작자에게 있습니다. 본 사이트는 이에 상응하는 법적 책임을 지지 않습니다. 표절이나 침해가 의심되는 콘텐츠를 발견한 경우 admin@php.cn으로 문의하세요.
핫 AI 도구
Undresser.AI Undress
사실적인 누드 사진을 만들기 위한 AI 기반 앱
AI Clothes Remover
사진에서 옷을 제거하는 온라인 AI 도구입니다.
Undress AI Tool
무료로 이미지를 벗다
Clothoff.io
AI 옷 제거제
AI Hentai Generator
AI Hentai를 무료로 생성하십시오.
인기 기사
R.E.P.O. 에너지 결정과 그들이하는 일 (노란색 크리스탈)
2 몇 주 전
By 尊渡假赌尊渡假赌尊渡假赌
Repo : 팀원을 부활시키는 방법
4 몇 주 전
By 尊渡假赌尊渡假赌尊渡假赌
헬로 키티 아일랜드 어드벤처 : 거대한 씨앗을 얻는 방법
3 몇 주 전
By 尊渡假赌尊渡假赌尊渡假赌
스플릿 소설을이기는 데 얼마나 걸립니까?
3 몇 주 전
By DDD
R.E.P.O. 파일 저장 위치 : 어디에 있고 그것을 보호하는 방법은 무엇입니까?
3 몇 주 전
By DDD
뜨거운 도구
메모장++7.3.1
사용하기 쉬운 무료 코드 편집기
SublimeText3 중국어 버전
중국어 버전, 사용하기 매우 쉽습니다.
스튜디오 13.0.1 보내기
강력한 PHP 통합 개발 환경
드림위버 CS6
시각적 웹 개발 도구
SublimeText3 Mac 버전
신 수준의 코드 편집 소프트웨어(SublimeText3)
뜨거운 주제
Gmail 이메일의 로그인 입구는 어디에 있나요?
7316
9
7316
9
자바 튜토리얼
1625
14
1625
14
Cakephp 튜토리얼
1349
46
1349
46
라라벨 튜토리얼
1261
25
1261
25
PHP 튜토리얼
1208
29
1208
29
CakePHP 프로젝트 구성
Sep 10, 2024 pm 05:25 PM
이번 장에서는 CakePHP의 환경 변수, 일반 구성, 데이터베이스 구성, 이메일 구성에 대해 알아봅니다.
Ubuntu 및 Debian용 PHP 8.4 설치 및 업그레이드 가이드
Dec 24, 2024 pm 04:42 PM
PHP 8.4는 상당한 양의 기능 중단 및 제거를 통해 몇 가지 새로운 기능, 보안 개선 및 성능 개선을 제공합니다. 이 가이드에서는 Ubuntu, Debian 또는 해당 파생 제품에서 PHP 8.4를 설치하거나 PHP 8.4로 업그레이드하는 방법을 설명합니다.
CakePHP 토론
Sep 10, 2024 pm 05:28 PM
CakePHP는 PHP용 오픈 소스 프레임워크입니다. 이는 애플리케이션을 훨씬 쉽게 개발, 배포 및 유지 관리할 수 있도록 하기 위한 것입니다. CakePHP는 강력하고 이해하기 쉬운 MVC와 유사한 아키텍처를 기반으로 합니다. 모델, 뷰 및 컨트롤러 gu
PHP 개발을 위해 Visual Studio Code(VS Code)를 설정하는 방법
Dec 20, 2024 am 11:31 AM
VS Code라고도 알려진 Visual Studio Code는 모든 주요 운영 체제에서 사용할 수 있는 무료 소스 코드 편집기 또는 통합 개발 환경(IDE)입니다. 다양한 프로그래밍 언어에 대한 대규모 확장 모음을 통해 VS Code는
