我遇到了一群黑客的麻烦。他们多次攻击了我客户的网站，我的客户变得更加愤怒:(我的客户丢失了他的数据库（有数百条记录），并且必须输入所有内容:(
现在我正在关注更多介绍；
- 固定文件权限
- 更改了 ftp 和主机登录信息
- 清除了所有远程 mysql 访问，
现在正在处理 SQL 注入问题。我将 mysql_real_escape_string 添加到管理面板登录参数中。那么我还应该在哪里使用这个 mysql_real_escape_string 呢？我认为我不需要在那里添加。 ..
我有一个index.php作为主页。我应该对此页面做些什么来防止通过像index.php?somesql=这样的url进行sql注入攻击吗
？ !!! :(
例如：
我有这样的代码；
public function showDetails($id) {
// SQL Jobs Details
$this->sql_job = "SELECT * FROM jobs WHERE id=".mysql_real_escape_string($id);
$this->rst_job = mysql_query($this->sql_job);
$this->row_all = mysql_fetch_assoc($this->rst_job);
// SQL State
$this->sql_state = "SELECT title FROM state WHERE id=" . $this->row_all[$this->tbl_jobs['f4']];
$this->rst_state = mysql_query($this->sql_state);
$this->row_state = mysql_fetch_assoc($this->rst_state);
........
对 $id 使用 mysql_real_escape_string 是否足够。不适用于 $this->row_all[$this->tbl_jobs['f4']]
I'm in trouble with a group of hackers. they hacked my client's site few times, and my client gets more angry :( my client lost his database (which has hundreds records), and had to enter all :(
now I'm following some more introductions;
- fixed file permissions
- changed ftp and host login info
- cleared all remote mysql accesses
now working on SQL Injection issue. I added mysql_real_escape_string to admin panel login paramaters. So where else should I use this mysql_real_escape_string ? I have few email forms at site, I dont think i need to add there...
I have an index.php as a mainpage. Should I do anything for this page to prevent any sql injection attack via url like index.php?somesql= ?
Please advise me! I appreciate so much!!! :(
for example:
I have such code;
public function showDetails($id) {
// SQL Jobs Details
$this->sql_job = "SELECT * FROM jobs WHERE id=".mysql_real_escape_string($id);
$this->rst_job = mysql_query($this->sql_job);
$this->row_all = mysql_fetch_assoc($this->rst_job);
// SQL State
$this->sql_state = "SELECT title FROM state WHERE id=" . $this->row_all[$this->tbl_jobs['f4']];
$this->rst_state = mysql_query($this->sql_state);
$this->row_state = mysql_fetch_assoc($this->rst_state);
........
is it enough to use mysql_real_escape_string for $id . not for $this->row_all[$this->tbl_jobs['f4']]
发布评论
评论（4）
基本上，每次您在 SQL 中使用一些不安全数据（用户输入、数据库中的值、文件或外部网站，即您不能100%确定其安全的任何数据）时查询，您应该使用 mysql_real_escape_string 转义它。请注意，根据 OWASP，此函数对于转义动态表来说并不安全名称（但这远不如“基本”用户输入插入常见）。
我建议你看一下关于 SQL 注入的 OWASP 文章，并且浏览网站的其余部分。它是有关 Web 应用程序安全性的重要信息来源。
IMO，防止 SQL 注入的首选方法是使用 准备好的声明。
请记住，如果您选择使用
mysql_real_escape_string()，它仅在以下情况下有效：在由引号分隔的字符串内使用。切勿将其用于
任何未加引号的值。这包括数值；相反，验证用户输入实际上是数字。
Basically, each time you use some unsafe data (user input, value from a database, a file or an external website, i.e. any data that you are not 100% sure that it is safe) in a SQL query, you should escape it using mysql_real_escape_string. Note that according to OWASP, this function is not secure for escaping dynamic table names (but this is far less common than "basic" user input insertion).
I suggest you to have a look at the whole OWASP article on SQL injection, and also to browse the rest of the website. It's a great source of information about security in web applications.
IMO, the preferred way of preventing SQL injection is to use prepared statements.
Please remember that if you do choose to use
mysql_real_escape_string()it only works whenused inside a string that is delimited by quotes. Never use it on
any unquoted values. This includes numeric values; instead, validate that the user-input is actually numeric.
与用户输入相关的两个最重要的事情是
输入过滤是转换数据/[之前]/存储在数据库中的过程。执行 mysql_real_escape_string() 属于此步骤（尽管有更好的方法来清理数据库插入的用户数据），但此步骤还可以包括修剪空格、脏话过滤、标记转换等。
当将用户内容发送到浏览器时，输出转义会小心谨慎，不允许恶意行为。这意味着执行
htmlentities()或其他一些选择性筛选过程。您还可以执行其他操作，例如资源限制（DOS 预防）、表单令牌（CSRF 保护）等。转到 OWASP 并开始阅读。
The two biggest things to do with user input are
Input Filtering is the process of transforming the data /[before]/ it's stored in the database. Executing
mysql_real_escape_string()falls under this step (although there are better ways to sanitize user data for db insertion), but this step can also include trimming white-space, profanity filtering, markup conversion, and more.Output Escaping is taking care when send user-content to the browser that you don't allow malicious behavior. This means executing
htmlentities()or some other selective screening process.There are other things you can do, like resource throttling (DOS prevention), form tokens (CSRF protection), etc. Go to OWASP and start reading.
Web 开发的黄金法则之一是永远（永远！）信任用户输入。因此，只要有数据进入数据库，就应该调用 mysql_real_escape_string()。
另外，为了防止将来客户生气，您应该定期备份数据库。如果我是你的客户，我现在会很生气。
祝您网站安全顺利。
One of the golden rules of web development is NEVER (EVER!) trust user input. Therefore, anywhere you have data going into the database, you should call mysql_real_escape_string().
Also, to prevent angry clients in the future, you should regularly backup your database. If I were your client, I would be furious right now.
Good luck in securing your site.
防止 SQL 注入的最佳方法是使用准备好的语句和绑定变量。您使用什么版本的 MySQL？准备好的语句在 4.1 及更高版本中可用。
The best way to prevent SQL injection is with use of prepared statements and bind variables. What version of MySQL are you using? Prepared statements are available in 4.1 and higher.