一、没有进行预处理的SQL语句
women没'; $add_time = date("Y-m-d H:i:s"); // 转义字符 $content = mysql_real_escape_string($content); $content = htmlspecialchars($content, ENT_COMPAT); // 你是/谁啊，大几都做做&>women没 // 自动过滤反斜杠/* // 4.插入一条数据 $insert_sql = "insert into post_tbl (title, content, user_id, add_time) values ('{$title}', '{$content}', '4742551', '{$add_time}')"; if(mysql_query($insert_sql)) { echo 'ok'; } else { echo "Error : " . mysql_error(); } $ret = mysql_affected_rows(); print_r($ret); */ // 5.PDO预处理插入 // PDO（PHP Data Object）则是提供了一个 Abstraction Layer 来操作数据库 // 查询 $user_id = 174742; $password = "''or '1=1'" ; $sql = "select * from post_tbl where user_id = {$user_id} and password = {$password}"; print_r($sql); $query = mysql_query($sql); // $result = mysql_fetch_array($query); $rows = array(); while($row=mysql_fetch_array($query)) { $rows[] = $row; } print_r( $rows); // 关闭数据库连接 mysql_close($conn);/*$str = "Bill & 'Steve'";echo htmlspecialchars($str, ENT_COMPAT); // 只转换双引号echo "
";echo htmlspecialchars($str, ENT_QUOTES); // 转换双引号和单引号echo "
";echo htmlspecialchars($str, ENT_NOQUOTES); // 不转换任何引号*//*以上代码的 HTML 输出如下（查看源代码）：Bill & 'Steve'
Bill & 'Steve'
Bill & 'Steve'以上代码的浏览器输出：Bill & 'Steve'Bill & 'Steve'Bill & 'Steve'*/ function mforum_html_tag_to_html_entity($content){ $content = (string)trim($content); if(empty($content)) return ''; // $content = str_replace(' ', ' ', $content); $content = htmlspecialchars($content, ENT_COMPAT, GB2312, false); $content = str_replace(">", ">", $content); $content = str_replace("<", "<", $content); $content = str_replace(""", """, $content); $content = preg_replace("/\$/", "$", $content); $content = preg_replace("//", "", $content); $content = str_replace("!", "!", $content); $content = str_replace("'", "'", $content); $content = preg_replace("/\/", "\", $content); // 内容敏感词过滤 return $content;}
二、PDO处理的SQL语句
setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $dbh->exec('set names utf8'); $title = "我们的爱情";$content = '你是/谁啊，大几都"老梁"做做&>women没' . " 测试打印号'我是单引号'哈哈";$user_id = 174742;$add_time = date("Y-m-d H:i:s");// $insert_sql = "insert into post_tbl (title, content, user_id, add_time) values (:x_title, :x_content, :x_user_id, :x_add_time)";// $stmt = $dbh->prepare($insert_sql); // $stmt->execute(array('x_title'=>$title,':x_content'=> $content, ':x_user_id' => $user_id, ':x_add_time' => $add_time)); // 查询$user_id = "17474#";// $password = "''or '1=1'"; $password = 123456;$sql = 'select * from post_tbl where user_id = :x_user_id and password = :x_password';$stmt = $dbh->prepare($sql); $stmt->execute(array(':x_user_id'=>$user_id, ':x_password' => $password)); $rows = array();while($row = $stmt->fetch(PDO::FETCH_ASSOC)){ $rows[] = $row; } print_r($rows); // echo $dbh->lastinsertid();
版权声明：本文内容由互联网用户自发贡献，该文观点仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。
如发现本站有涉嫌抄袭侵权/违法违规的内容， 请发送邮件至 chuangxiangniao@163.com 举报，一经查实，本站将立刻删除。
发布者：程序猿，转转请注明出处：https://www.chuangxiangniao.com/p/1082341.html
微信扫一扫 
支付宝扫一扫 
