PHP PDO 准备好的语句需要转义吗？
在 PDO::Prepare 页面 上指出，
“并且无需手动引用参数，有助于防止 SQL 注入攻击”
知道了这一点，是否有像 mysql_real_escape_string() 这样的 PHP 函数可以处理 PDO 的转义问题？或者 PDO 会帮我处理所有的转义吗？
编辑
我现在意识到我问了错误的问题。我的问题实际上是：“PDO 为我提供什么服务？”我现在通过这些答案意识到，它实际上只是消除了转义引号的需要。但我仍然需要对传递给执行函数的值执行任何其他 PHP 清理调用。比如htmlentities()、strip_tags()...等...
On the PDO::Prepare page it states,
"and helps to prevent SQL injection attacks by eliminating the need to manually quote the parameters"
Knowing this, is there a PHP function like mysql_real_escape_string() that takes care of escaping stings for PDO? Or does PDO take care of all escaping for me?
EDIT
I realize now that I asked the wrong question. My question really was, "What all does PDO take care of for me?" Which I realize now with these answers that it really only removes the need to escape the quotes. But I would still need to do any other PHP sanitize calls on the values that I pass to the execute function. Such as htmlentities(), strip_tags()...etc...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
你不必担心它。 PDO 不要求您在将数据传递到数据库之前转义数据。
编辑：为了清楚起见，我的意思是只要您将变量传递到参数中（例如，表单字段的值），您就不必担心它。但是，例如，如果您传递定义为字符串的变量，那么显然您需要转义该字符串中需要转义的任何内容，以避免破坏语法。然而，这甚至没有多大意义，因为 PDO 的主要优点之一是您将信息从用户传递到数据库，而不必自己清理它，并且没有很多次（如果有的话？）您将传递您自己定义的字符串。
另外，请确保您仍按类型清理数据。例如，如果您希望它是整数，请确保它是整数；如果您希望它是整数，请确保它小于或大于 x 等等。
You don't have to worry about it. PDO does not require you to escape your data before passing it along to the database.
Edit: Just to be clear, I mean to say that as long as you are passing variables into your parameters (for example, the value of a form field), you don't have to worry about it. However, if you're passing variables that you've defined as strings, for example, then obviously you need to escape anything that needs escaping in that string in order to avoid breaking syntax. However, this wouldn't even make much sense since one of the main advantages of PDO is that you're passing information from the user to the database without having to sanitize it yourself, and there aren't many times (if any?) that you would be passing strings that you yourself had defined.
Also, make sure you still sanitize your data for type. For example, make sure it's an integer if you expect it to be, make sure it's less than or greater than x if you expect it to be, etc.
PDO 不会转义变量。变量和 SQL 命令通过 MySQL 连接独立传输。 SQL 标记器（解析器）从不查看值。值只是逐字复制到数据库存储中，不可能造成任何损害。这就是为什么不需要使用准备好的语句转义数据。
如果您连接 SQL 命令并且实际上没有使用准备好的语句（不好！），那么是的，PDO 有一个字符串格式化函数，$pdo->quote($string)，将字符串放在引号中并转义这些引号（以及其他一些引号）字符）内。
PDO does not escape the variables. The variables and the SQL command are transferred independently over the MySQL connection. And the SQL tokenizer (parser) never looks at the values. Values are just copied verbatim into the database storage without the possibility of ever causing any harm. That's why there is no need to escape the data with prepared statements.
If you concat the SQL command and don't actually use prepared statements (not good!), then yes, PDO has a formatting function for strings, $pdo->quote($string), that puts your string in quotes and escapes these quotes (along with some other characters) inside.
这里很少有人了解转义是什么以及何时使用它。
转义本身并不会使任何数据变得“安全”。它只是转义分隔符，以区分分隔符和数据的一部分。
field = 'it's me'会导致错误，而field = 'it\'s me'则不会。这就是逃跑的唯一目的。因此，仅当您使用引号时它才有效。如果你不这样做——逃避就变得毫无用处。您使用带占位符的引号吗？不。因此，逃避是不明智的。
当您绑定变量时，它的工作方式非常不同：它不会将整个查询发送到服务器，而是发送与绑定数据分开的准备好的查询。所以它不能干涉。因此不可能进行注射。
Very few people here understand what escaping is and when to use it.
Escaping itself does not make any data "safe". It just escapes delimiters, to distinguish a delimiter from a part of data.
field = 'it's me'will cause an error, whilefield = 'it\'s me'will not. That's the only purpose of escaping. So, it works only when you use quotes. If you don't - escaping becomes useless.Do you use quotes with placeholders? No. Thus, no escaping would be sensible.
When you are binding your variables, it works a very different way: it does not send the whole query to the server, but sends your prepared query separated from the bound data. So it cannot interfere. And thus makes no injection possible.
是和否：
Yes and no:
如果您准备声明并使用 bindParam 或 bindValue 来提供变量，您不需要转义变量。请注意，这些函数假设变量包含字符串，因此如果您想使用布尔值或浮点数，请使用第三个参数来绑定值。
If you prepare a statement and use bindParam or bindValue to supply variables, you do not need to escape the variables. Note that these functions assume that the variable contains a string, so use the third parameter to bindValue if you want to use booleans or floats.