PHP MySQL - 清理和验证建议
我刚刚发现 PHP 清理和验证过滤器，并且我一直在使用 MySQL 的 mysql_escape_string 来阻止 SQL 注入。
现在我发现 PHP 也可以提供帮助，并且我想从逻辑上讲，这些过程在其功能上并不是排他性的：即，您可以在 PHP 中进行清理和验证，但仍然会遇到需要转义的情况。
我是对的还是我忽略了某些事情？
I'm just discovering PHPs sanitize and Validate filters, and I had been using MySQL's mysql_escape_string to stop SQL Injection.
Now I discover that PHP can also help and I guess logically these procedures are not exclusive in their function: ie you can sanitize and validate in PHP and still arrive at a situation where escaping is necessary.
Am I right or am I overlooking something?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，你完全正确。为休闲读者提供的大字体可能会以某种方式错过您的问题的要点。
不同类型的输出需要不同类型的保护。
消除可能是 HTML 的内容，这样您就可以更安全地抵御 XSS。正确引用并转义您的数据库输入，您将更安全地抵御 SQL 注入。留意各处的意外输入，您将提高代码的安全性。
你现在完全意识到这一点，这是一件美妙的事情。太多人不。
这些都很好，不是吗？它们是现代 PHP 的重要组成部分。虔诚地使用它们，它们不会让你失望。除了电子邮件之外，它未能解决大量边缘案例；我更喜欢 is_email。
这……不是现代 PHP 的一个很好的部分。我还希望您使用包含“real”一词的转义字符串函数，否则您可能会遇到麻烦。
我认为您已准备好进行下一步：学习 PDO。它有准备好的语句和查询占位符，它将为您提供免费和当您正确使用它时，可以完全防止 SQL 注入。 PDO 可以在任何有现代 PHP 版本的地方使用。它是内置的。使用它、学习它、喜欢它。否则你就注定失败。注定了！
Nope, you're totally right. Big font incoming for the casual readers that might somehow miss the point of your question.
Different types of output require different types of protection.
Nuke things that could be HTML, and you'll be safer against XSS. Properly quote and escape your database input, and you'll be safer against SQL Injection. Watch for unexpected input everywhere and you will increase the safety of your code.
It is a wonderful thing that you now fully realize this. Too many people don't.
These are nice, aren't they? They're a good part of modern PHP. Use them religiously and they will not fail you. Except for the email one, it fails a large number of edge-ish cases; I prefer is_email.
This is ... not a good part of modern PHP. I also hope you're using the escape string function with the word "real" in it, otherwise you may be in trouble.
I think you are ready for the next step: Learn PDO. It has prepared statements and query placeholders, which will provide you free and complete protection against SQL Injection, when you use it properly. PDO is available anywhere that modern PHP versions are available. It's built right in. Use it, learn it, love it. Or else you are doomed. Doomed!
我建议您使用数据库扩展提供的适当的编码感知函数或方法来转义插入查询中的每一位数据。对于
mysql_这将是mysql_real_escape_string（不要忘记real_部分！）。推理很简单：代码不断发展。经常会发生对某个值的限制被放松的情况。想象一下，您以前只允许名称中包含字母数字字符，而现在您希望允许所有 Unicode 字符。因此现在名称 2 中允许使用
'。但遗憾的是，您的代码中没有mysql_real_escape_string，因为您认为该名称是安全的。好吧，现在已经太晚了，私人用户数据已被读取，现在在黑市上流通......I would advise you to escape every single bit of data you insert into a query with the appropriate encoding-aware function or method your database extension provides. For
mysql_this would bemysql_real_escape_string(don't forget thereal_part!).The reasoning is simple: Code evolves. It may often happen, that restrictions for a value are loosened. Imagine you allowed only alphanumeric characters for names before and now you want to allow all Unicode characters. Thus now
'is allowed in names two. But too bad you didn't have thatmysql_real_escape_stringin your code, because you thought the name were safe. Well, now it's too late, the private user data was read and now circulates on the black market...