是否有可能通过selectbox（动态创建或静态）进行sql注入
我想知道是否有可能通过选择框选项进行 SQL 注入？ 如果是，那么请您展示一些演示（或参考任何链接）。 还告诉我如何防止 selectbox 中的 sql 注入。（使用 PHP MYSQL）
还有一个：如果我动态创建一个 selectbox（基于另一个选择框的选项），那么是否有 SQL 注入的机会？
谢谢你。
i want to know that is there any chance of SQL injection via selectbox options?
if yes then will u please show some demonstration(or refer any link).
and also tell me how do we prevent sql injection in selectbox.(using PHP MYSQL)
one more: if i create a selectbox dynamically( based on options of another select box) then is there any chance of SQLinjection?
Thanking you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的。攻击者可以创建自己的 HTML 表单并将其发布到您的 URL。 Firefox（Web 开发工具栏）甚至有一个插件，可以将任何页面上的选择字段更改为文本框。
您永远不能信任浏览器发送的数据（$_GET、$_POST、$_COOKIE、$_REQUEST）。始终清理您的输入。
Yes. The attacker can just make up her own HTML form and post it to your URL. There are even a plugin to Firefox (Web Developer Toolbar) which can change the select field to a textbox on any page.
You can never trust data sent by the browser ($_GET, $_POST, $_COOKIE, $_REQUEST). Always sanitize your input.
是的，仍然有可能通过选择框进行 SQL 注入。回发后，客户端实际上可以在选择框的字段中放置他们喜欢的任何内容，它不必是列表中的值之一。
您应该始终验证您的输入，无论它来自何处。现在，除了针对 SQL 注入的“标准”防御（例如参数化查询等）之外，您还可以使用选择框添加额外的检查，以确保回发的值实际上是我们首先在列表中列出的值之一（当然，这是假设您的客户端上没有可以修改可能值列表的 JavaScript）。
Yes, there is still a chance of SQL injection with a select box. Upon postback, the client can actually put anything they like in the field for the select box, it doesn't have to be one of the values in the list.
You should always be validating your input, no matter where it comes from. Now, apart from the "standard" defences against SQL injection (e.g. parameterised queries, etc), with a select box you can add an extra check that the value posted back was actually one of the values that we in the list in the first place (this is assuming that you don't have javascript on the client that modifies the list of possible values, of course).
注入不是通过表单完成的，而是通过处理表单的 PHP 完成的。人们可以将任意数据作为名称/值对发送到您的代码，而您无法知道它是来自选择框、输入字段还是只是当场编写。 始终验证来自表单的任何数据。始终假设它已受到损害。
选择框确实有助于您知道应该发送哪些值。如果发送的值不在那个小集合中，那么您就知道正在发生一些有趣的事情，您可以安全地丢弃所有输入并给出错误。最好验证代码中传入和传出的所有内容。否则，你就会给自己带来麻烦，甚至可能是你无意中做的一些事情。
The injection is not done through the form, but through the PHP that handles the form. A person can send any arbitrary data as a name/value pair to your code and you would have no way of knowing whether it came from a select box, an input field, or was just made up on the spot. Always validate any data that comes from a form. Always assume that it is compromised.
A select box does help in that you know what values should be sent. If a value sent is not in that small set, then you know that something funny is going on and you can discard all of the input safely and give an error. It is good to verify everything that comes in to your code and out of it. Otherwise, you are setting yourself up for trouble, perhaps even by something that you did by accident.