Prevent injection SQL with PHP [duplicate]

Since my statements are like

"SELECT * FROM `box` WHERE `thing` = '{$variable}'

Could I clean that with simply

$variable = str_replace("'","\'",$variable);
"SELECT * FROM `box` WHERE `thing` = '{$variable}'

Would that work? My host doesn't support mysql escape and I'm not using mysqli.

Depending on what classes as a valid data type for your query, you can usually get away with:

function cleanVar($str){
    $str = strip_tags(addslashes($str));
    return $str;
}

Use parametrized queries (PDO is probably your best bet).

I highly doubt that your host doesn't support the mysql_real_escape_string function.

$variable = mysql_real_escape_string($variable);

$sql = "SELECT * FROM `box` WHERE `thing` = '{$variable}'";

If indeed you don't have MySQL installed, then you can use one of the following escape functions based on which RDBMS you're using:

If it's postgres you can use pg_escape_string.

Hate to repeat myself, but, once again, try this one:
PHP Intrusion Detection System

来源：https://stackoverflow.com/questions/4309237/prevent-injection-sql-with-php

标签

易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!