无法使用 mysql_real_escape_string

发布于 2024-09-27 05:17:55 字数 996 浏览 8 评论 0原文

因此，我在使用 mysql_real_escape_string 时收到此警告

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'username'@'localhost' (using password: NO) in /home/path/php/functions.php on line 11

网站的其余部分工作正常，连接到数据库等，但在使用此函数时出现错误。

它在我的本地主机测试服务器上工作得很好。

有什么想法吗？

我在我自己的自制字符串清理函数中使用上述函数：

function sani($string){     
  $string = strip_tags($string); 
  $string = htmlspecialchars($string); 
  $string = trim(rtrim(ltrim($string))); 
  $string = mysql_real_escape_string($string);
  return $string;
}

并且我每次执行查询时都使用此函数...

function mm_mysqlquery($query) {
 if (MM_DEBUG == true) { echo "Query: $query <br>"; mm_log("Query: $query"); } //print query if MM_DEBUG
 $link = mysql_connect(DB_HOST, DB_USER, DB_PASS) or die ("mysql_error: " . mysql_error());
 $db_selected = mysql_select_db(DB_NAME);
 return mysql_query($query, $link);
}

预先感谢！

原文

So, I'm getting this warning when using mysql_real_escape_string

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'username'@'localhost' (using password: NO) in /home/path/php/functions.php on line 11

The rest of the site works fine, connects to the DB and all, but I get an error when using this function.

It works completely fine on my localhost testing server.

Any ideas?

I use aforementioned function in my own homebrew string sanitation function:

function sani($string){     
  $string = strip_tags($string); 
  $string = htmlspecialchars($string); 
  $string = trim(rtrim(ltrim($string))); 
  $string = mysql_real_escape_string($string);
  return $string;
}

And I use this function every time I do queries...

function mm_mysqlquery($query) {
 if (MM_DEBUG == true) { echo "Query: $query <br>"; mm_log("Query: $query"); } //print query if MM_DEBUG
 $link = mysql_connect(DB_HOST, DB_USER, DB_PASS) or die ("mysql_error: " . mysql_error());
 $db_selected = mysql_select_db(DB_NAME);
 return mysql_query($query, $link);
}

Thanks on beforehand!

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

美人如玉 2024-10-04 05:17:55

第一点：如果您从 mysql_real_escape_string() 中收到错误，那是因为您在连接到数据库之前调用了该函数。

看起来您在运行查询之前就连接到了数据库。因此，在调用 mm_mysqlquery() 函数之前执行的任何操作都不会建立连接。

mysql_real_escape_string() 函数需要与数据库的实时连接，因此它可以针对连接的字符集进行正确的转义。因此，您需要在进行转义之前先进行连接。

无论如何，最好这样做，因为如果您在单个 PHP 请求过程中进行多个查询，则连接一次并为所有查询使用相同的连接会减少开销。

其次，请不要采纳使用 addslashes() 的建议——它与 mysql_real_escape_string() 的作用不同。两者不可互换。您应该养成使用mysql_real_escape_string()的习惯。

第三，您的 sani() 函数显示了一个常见的误解。

function sani($string){     
  $string = strip_tags($string); 
  $string = htmlspecialchars($string); 
  $string = trim(rtrim(ltrim($string))); 
  $string = mysql_real_escape_string($string);
  return $string;
}

常见的误解是您需要所有这些函数才能使 SQL 语句中的字符串安全。你不知道。只需要mysql_real_escape_string()。此示例中的所有其他函数对于防止 SQL 注入没有任何作用。

如果您在 HTML 演示文稿中输出字符串并且希望降低 XSS 攻击的风险，那么这些函数非常有用，但是 mysql_real_escape_string() 就无关紧要了。

在适当的环境中使用每种类型的消毒方法。

First point: If you're getting an error from mysql_real_escape_string(), it's because you are calling the function before you're connected to the database.

It looks like you connect to the database right before you run a query. So anything you do before you call your mm_mysqlquery() function won't have a connection.

The mysql_real_escape_string() function needs a live connection to the database, so it can do the right kind of escaping with respect to the connection's character set. So you need to connect before you do escaping.

It's better to do that anyway, because if you make several queries during the course of a single PHP request, it's less overhead to connect once and use the same connection for all your queries.

Second, please don't take suggestions to use addslashes() -- it does not do the same thing as mysql_real_escape_string(). The two are not interchangeable. You should get into the habit of using mysql_real_escape_string().

Third, your sani() function shows a common misconception.

function sani($string){     
  $string = strip_tags($string); 
  $string = htmlspecialchars($string); 
  $string = trim(rtrim(ltrim($string))); 
  $string = mysql_real_escape_string($string);
  return $string;
}

The common misconception is that you need all these functions to make a string safe in an SQL statement. You don't. Only mysql_real_escape_string() is necessary. All the other functions in this example do nothing to protect against SQL injection.

Those functions are useful if you output a string in an HTML presentation and you want to reduce the risk of XSS attacks, but then mysql_real_escape_string() is irrelevant.

Use each type of sanitizing method in its appropriate context.

回复收藏 0 原文