PHP 要预防 SQL Injection, 可以用 PHP 内建功能实现, 下面分别是 PDO 及 MySQLi 预防方法:
PDO:
|
1 2 3 4 5 6 |
$sql = $pdo->prepare('SELECT * FROM users WHERE username = :username'); $sql->execute(array('username' => $username)); foreach ($sql as $row) { // do something with $row } |
MySQLi:
|
1 2 3 4 5 6 7 8 9 |
$sql = $dbConnection->prepare('SELECT * FROM users WHERE username = ?'); $sql->bind_param('s', $username); $sql->execute(); $result = $sql->get_result(); while ($row = $result->fetch_assoc()) { // do something with $row } |