过滤 SQL 注入的 URL 查询字符串 - PHP
我收到一个需要修复的网站，该网站最近被 SQL 注入攻击。据我所知，Havij 自动 SQL 注入器用于将代码插入到 url 的查询字符串参数中。
该网站是一个定制的 CMS 构建，有点过时。我认为全面重建是不可能的。
防止这种情况再次发生的最佳方法是什么？我是一名 PHP 开发人员，但通常只是对表单进行验证，或者使用已经内置此功能的系统 - wordpress、codeigniter、drupal 等。
任何想法或想法都会受到赞赏。
谢谢
I've been given a site to fix that was recently hacked using SQL injection. From what I can gather the Havij automated SQL injector was used to insert code into the query string parameters of the url.
The site is a custom CMS build and a bit dated. I don't think a full rebuild is likely.
What's the best way to prevent this from occurring again? I'm a PHP developer, but usually just do validations on forms, or use systems that have this functionality already built in - wordpress, codeigniter, drupal etc.
Any ideas or thoughts are appreciated.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
只有一个简单的规则：放入 sql 查询中的每个变量（无论它来自哪里 - 来自用户还是已经从数据库获取的内容）都应该使用 <代码>mysql_real_escape_string()之前。
或者您可以使用准备好的查询（准备好的语句/占位符），这并不重要。
There is only one simple rule: every variable (doesn't matter where it came from - from user or it is something already gotten from database) that is being put into the sql query should be sanitized with
mysql_real_escape_string()before.Or you could use prepared queries (prepared statements/placeholders), doesn't matter.
您可能无法更改所有代码，但也许您可以更改数据库代码。如果是这样，请尝试使用 PDO 和准备好的语句。我推荐 pdo 因为你没有指定数据库类型。如果你使用mysql，我认为mysqli也提供了准备好的语句。
You may not be able to change all of the code, but maybe you can change the database code. If so try using PDO and prepared statements. I recommend pdo because you didn't specify the database type. If you are using mysql, I think mysqli also provides prepared statements.
$url = filter_var($url, FILTER_SANITIZE_URL);
$url = filter_var($url, FILTER_SANITIZE_URL);