PHP 对 GET 参数的保护

问题描述

好的考虑这个网址:

example.com/single.php?id=21424

很明显，PHP 将获取 ID 并通过 mysql 查询运行它以检索 1 条记录以将其显示在页面上.

It's pretty obvious to you and i that the PHP is going to take the id and run it through a mysql query to retrieve 1 record to display it on the page.

无论如何，是否有一些恶意黑客可能会弄乱这个 url 并对我的应用程序/mysql 数据库构成安全威胁?

Is there anyway some malicious hacker could mess this url up and pose a security threat to my application/mysql DB?

谢谢

推荐答案

当然，永远不要认为用户条目(_GET、_POST、_COOKIE 等)是安全的.

Of course, never ever ever consider a user entry (_GET, _POST, _COOKIE, etc) as safe.

使用 mysql_real_escape_string php 函数来清理你的变量:http://php.net/manual/en/function.mysql-real-escape-string.php

Use mysql_real_escape_string php function to sanitize your variables: http://php.net/manual/en/function.mysql-real-escape-string.php

关于 SQL 注入:http://en.wikipedia.org/wiki/SQL_injection

这篇关于PHP 对 GET 参数的保护的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！