清理 MySQL 用户参数

发布于 2024-07-07 01:46:42 字数 201 浏览 8 评论 0原文

当用户的输入将被插入到 MySQL 查询中时，用户输入中应该替换哪些危险字符？我知道引号、双引号、\r 和 \n。还有其他吗？
_{（我无法选择使用接受参数的智能连接器，因此我必须自己构建查询，这将用多种编程语言实现，包括一些晦涩难懂的语言，因此解决方案例如 PHP 中的 mysql_real_escape_string 无效）}

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

沙沙粒小 2024-07-14 01:46:42

mysql_real_escape_string() 来自 mysql。 com 文档：

考虑到连接的当前字符集，from 中的字符串被编码为转义 SQL 字符串。结果被放入 to 中并附加一个终止空字节。编码的字符为 NUL (ASCII 0)、“\n”、“\r”、“\”、“'”、“"” 和 Control-Z（请参见第 8.1 节“文字值”）。（严格来说， MySQL 仅要求转义反斜杠和用于在查询中引用字符串的引号字符。此函数引用其他字符以使它们更易于在日志文件中读取。）

mysql_real_escape_string()

> 具有字符集感知能力 addslashes_dont_call_it_a_comeback.html" rel="nofollow noreferrer">http://cognifty.com/blog.entry/id=6/addslashes_dont_call_it_a_comeback.html：

AS = addslashes()  
MRES = mysql_real_escape_string()
ACS = addcslashes() //called with "\\\000\n\r'\"\032%_"

Feature                                         AS     MRES    ACS
escapes quote, double quote, and backslash      yes    yes     yes
escapes LIKE modifiers: underscore, percent     no     no      yes
escapes with single quotes instead of backslash no     yes*1   no
character-set aware                             no     yes*2   no
prevents multi-byte attacks                     no     yes*3   no

mysql_real_escape_string() from mysql.com docs:

The string in from is encoded to an escaped SQL string, taking into account the current character set of the connection. The result is placed in to and a terminating null byte is appended. Characters encoded are NUL (ASCII 0), “\n”, “\r”, “\”, “'”, “"”, and Control-Z (see Section 8.1, “Literal Values”). (Strictly speaking, MySQL requires only that backslash and the quote character used to quote the string in the query be escaped. This function quotes the other characters to make them easier to read in log files.)

mysql_real_escape_string() is character set aware, so replicating all its abilities (especially against multi-byte attack issues) is not a small amount of work.

From http://cognifty.com/blog.entry/id=6/addslashes_dont_call_it_a_comeback.html:

AS = addslashes()  
MRES = mysql_real_escape_string()
ACS = addcslashes() //called with "\\\000\n\r'\"\032%_"

Feature                                         AS     MRES    ACS
escapes quote, double quote, and backslash      yes    yes     yes
escapes LIKE modifiers: underscore, percent     no     no      yes
escapes with single quotes instead of backslash no     yes*1   no
character-set aware                             no     yes*2   no
prevents multi-byte attacks                     no     yes*3   no

回复收藏 0 原文