Mysql安全性測試-PHP开发-PHP中文網

首頁

php教程

PHP开发

Mysql安全性測試

Nov 19, 2016 pm 04:08 PM

mysql

一、没有进行预处理的SQL语句

&lt;?php
    
    // 1.连接数据库
  $conn = mysql_connect(&#39;127.0.0.1:3306&#39;, &#39;root&#39;, &#39;518666&#39;);
  if (!$conn)
  {
    die(&quot;Could not connect:&quot; . mysql_error());
  }

  // 2.选择数据库
  mysql_select_db(&#39;mysql_safe&#39;, $conn);


  // 3.设置编码,注意这里是utf8而不是utf-8,如果写后者，MySQL不会识别的，会出现乱码的。
  mysql_query(&quot;SET NAMES utf8&quot;);

  $title    = &quot;我们的爱情&quot;;
  $content  = &#39;你是/谁啊，大几\都&quot;老梁&quot;做做&amp;&gt;women&lt;a&gt;没&#39;;
  $add_time = date(&quot;Y-m-d H:i:s&quot;);

  // 转义字符
  $content = mysql_real_escape_string($content);
  $content = htmlspecialchars($content, ENT_COMPAT);
  // 你是/谁啊，大几都做做&amp;amp;&amp;gt;women&amp;lt;a&amp;gt;没   // 自动过滤反斜杠
/*
  // 4.插入一条数据
  $insert_sql = &quot;insert into post_tbl (title, content, user_id, add_time) values (&#39;{$title}&#39;, &#39;{$content}&#39;, &#39;4742551&#39;, &#39;{$add_time}&#39;)&quot;;
 if(mysql_query($insert_sql))
  {
    echo &#39;ok&#39;;

  }
  else
  {
    echo &quot;Error : &quot; . mysql_error();
  }
   $ret = mysql_affected_rows();
  print_r($ret);
  */
   // 5.PDO预处理插入
   // PDO（PHP Data Object）则是提供了一个 Abstraction Layer 来操作数据库
    // 查询
    $user_id  = 174742;
    $password = &quot;&#39;&#39;or &#39;1=1&#39;&quot; ;
    $sql = &quot;select * from post_tbl where user_id = {$user_id} and password = {$password}&quot;;

    print_r($sql);
    $query  = mysql_query($sql);
    // $result = mysql_fetch_array($query);

    $rows = array();
    while($row=mysql_fetch_array($query))
    {
         $rows[] = $row;
    }

   
    print_r( $rows);




  // 关闭数据库连接
  mysql_close($conn);

/*

$str = &quot;Bill &amp; &#39;Steve&#39;&quot;;
echo htmlspecialchars($str, ENT_COMPAT); // 只转换双引号
echo &quot;&lt;br&gt;&quot;;
echo htmlspecialchars($str, ENT_QUOTES); // 转换双引号和单引号
echo &quot;&lt;br&gt;&quot;;
echo htmlspecialchars($str, ENT_NOQUOTES); // 不转换任何引号
*/

/*
以上代码的 HTML 输出如下（查看源代码）：
&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;body&gt;
Bill &amp;amp; &#39;Steve&#39;&lt;br&gt;
Bill &amp;amp; &amp;#039;Steve&amp;#039;&lt;br&gt;
Bill &amp;amp; &#39;Steve&#39;
&lt;/body&gt;
&lt;/html&gt;
以上代码的浏览器输出：
Bill &amp; &#39;Steve&#39;
Bill &amp; &#39;Steve&#39;
Bill &amp; &#39;Steve&#39;
*/

  function mforum_html_tag_to_html_entity($content)
{
  $content = (string)trim($content);
  if(empty($content)) return &#39;&#39;;
  // $content = str_replace(&#39;&amp;nbsp;&#39;, &#39; &#39;, $content);
  $content = htmlspecialchars($content, ENT_COMPAT, GB2312, false);
  $content = str_replace(&quot;&amp;gt;&quot;, &quot;&amp;#62;&quot;, $content);
  $content = str_replace(&quot;&amp;lt;&quot;, &quot;&amp;#60;&quot;, $content);
  $content = str_replace(&quot;\&quot;&quot;, &quot;&amp;quot;&quot;, $content);
  $content = preg_replace(&quot;/\\\$/&quot;, &quot;&amp;#036;&quot;, $content);
  $content = preg_replace(&quot;/\r/&quot;, &quot;&quot;, $content);
  $content = str_replace(&quot;!&quot;, &quot;&amp;#33;&quot;, $content);
  $content = str_replace(&quot;&#39;&quot;, &quot;&amp;#39;&quot;, $content);
  $content = preg_replace(&quot;/\\\/&quot;, &quot;&amp;#092;&quot;, $content);

  // 内容敏感词过滤
  return $content;
}

登入後複製

二、PDO处理的SQL语句

&lt;?php  

// PDO的使用
// http://blog.csdn.net/qq635785620/article/details/11284591
$dbh = new PDO(&#39;mysql:host=127.0.0.1:3306;dbname=mysql_safe&#39;, &#39;root&#39;, &#39;518666&#39;); 
 
$dbh-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);    
$dbh-&gt;exec(&#39;set names utf8&#39;);   

$title    = &quot;我们的爱情&quot;;
$content  = &#39;你是/谁啊，大几\都&quot;老梁&quot;做做&amp;&gt;women&lt;a&gt;没&#39; . &quot; 测试打印号&#39;我是单引号&#39;哈哈&quot;;
$user_id  = 174742;
$add_time = date(&quot;Y-m-d H:i:s&quot;);

// $insert_sql = &quot;insert into post_tbl (title, content, user_id, add_time) values (:x_title, :x_content, :x_user_id, :x_add_time)&quot;;

// $stmt = $dbh-&gt;prepare($insert_sql); 
// $stmt-&gt;execute(array(&#39;x_title&#39;=&gt;$title,&#39;:x_content&#39;=&gt; $content, &#39;:x_user_id&#39; =&gt; $user_id, &#39;:x_add_time&#39; =&gt; $add_time));    

// 查询
$user_id  = &quot;17474#&quot;;
// $password = &quot;&#39;&#39;or &#39;1=1&#39;&quot;;
 $password = 123456;
$sql = &#39;select * from post_tbl where user_id = :x_user_id and password = :x_password&#39;;
$stmt = $dbh-&gt;prepare($sql);    
$stmt-&gt;execute(array(&#39;:x_user_id&#39;=&gt;$user_id, &#39;:x_password&#39; =&gt; $password));    

$rows = array();
while($row = $stmt-&gt;fetch(PDO::FETCH_ASSOC))
{   
   $rows[] = $row;    
    
}   
print_r($rows);    

// echo $dbh-&gt;lastinsertid();

登入後複製

本網站聲明

本文內容由網友自願投稿，版權歸原作者所有。本站不承擔相應的法律責任。如發現涉嫌抄襲或侵權的內容，請聯絡admin@php.cn