SQL注入预防技术仍然脆弱？
如果我使用 mysql_real_escape_string 和 addslashes 来避免网站中的 sql 注入攻击，这两个足以阻止 SQL 注入，因此 100% 确定现在没有人可以使用SQL注入？
If I'm using mysql_real_escape_string and addslashes to avoid sql Injection attack in my website is this two are enough to stop SQL Injection so its 100% sure no one can now attack using SQL Injection?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
这取决于您的查询；如果您只是谈论要插入数据库中的值，
mysql_real_escape_string就足够了，不需要addslashes。如果您还谈论变量表或列名，则需要白名单，并且
mysql_real_escape_string不会阻止对这些名称进行 sql 注入。所以答案确实是：不，这取决于您的查询。
It depends on your query; if you are talking about just the values you want to insert in your database,
mysql_real_escape_stringis enough, you don´t needaddslashes.If you also are talking about variable table or column names, you'll need white-lists as well as
mysql_real_escape_stringwill not prevent sql injection on these.So the answer really is: No, it depends on your query.
根本不要使用
addslashes；它不适合防止 SQL 注入。仅使用
mysql_real_escape_string。如果需要更改字符编码，请使用mysql_set_charset。Don’t use
addslashesat all; it’s not appropriate to protect against SQL injections.Use
mysql_real_escape_stringonly. And if you need to change the character encoding, usemysql_set_charset.没有任何简单的“神奇”方法可以防止 SQL 注入。
mysql_real_escape_string是一个好的开始，使用 PDO (docs ）甚至更好。最重要的是，您需要查看数据库结构、查询、数据源，然后进行思考。数据从哪里来？如果数据不符合我的预期会发生什么？创建代码的整个结构时应考虑控制应用程序逻辑的流程。防止 SQL 注入的最佳方法是了解并控制数据库中的内容。
There isn't any simple "magical" way to prevent SQL injection.
mysql_real_escape_stringis a good start, using PDO (docs) is even better. Above all of that, you need to look at your database structure, look at your queries, look at your data sources, then think it out. Where is data coming from? What would happen if the data isn't what I expect?The entire structure of your code should be created with a mind toward controlling the flow of your application logic. The best way to prevent SQL injection is to stay aware and in control of what goes in your database.
您永远不应该使用
addslashes。只要坚持mysql_real_escape_string无论如何，只有死亡是确定的。
如果你害怕死亡，你应该使用 PDO 来减少漏洞
http:// /it.php.net/manual/en/pdo.prepare.php
You should never use
addslashes. Just stick withmysql_real_escape_stringAnyway only the death is sure.
And if you fear the death you should use PDO to be less prone to vulnerabilities
http://it.php.net/manual/en/pdo.prepare.php
我想这取决于你的意思。
仅仅使用 mysql_real_escape_string 并不能 100% 地保护您，如果没有其他原因，可能会错误地使用它。
另一方面，正确使用 mysql_real_escape_string 应该可以为您提供接近 100% 的保护。
另一方面，与参数化查询相比，使用 mysql_real_escape_string 的程序员可能更容易犯错误。
如果您不确定您的代码，也许发布它并具体询问它可能更具教育意义/有用。
另外：同上其他人所说的关于addslashes的内容。
Depends on what you mean, I suppose.
The mere use of mysql_real_escape_string will not protect you with 100% certainty, if for no other reason than that it is possible to use it incorrectly.
On the other hand, the correct use of mysql_real_escape_string should protect you as close to 100% as you can get.
On yet some other hand, it is probably easier to make mistakes as a programmer using mysql_real_escape_string compared to a parameterized query.
If you are unsure about your code, perhaps posting it and asking about it specifically may be more educational/useful.
Also: Ditto what others are saying regarding addslashes.