评论区sql注入
我有一个由 2 个字段（标题和评论）组成的评论表单。数据库包含 3 列 id、标题和评论。评论是根据它的 title 显示的，如domain.com/index.php?id=sometitle
使用 mysql_real_escape_string 正确保护标题字段以进行 SQL 注入，但作为文本区域的注释字段保持打开状态而不会转义。我可以转义它，但是我想知道如果不在该字段上使用 mysql_real_escape_string 就留下它，知道标题已经转义并且这就是检索输出的方式，会造成什么危害。
I have a comment form that consists of 2 fields (title and comment). Database contains 3 columns id, title and comment. Comment is displayed based on it's title like domain.com/index.php?id=sometitle
The title field is properly secured for sql injection using mysql_real_escape_string, but comment field which is a textarea is left open without escaping. I can escape it, however i'm wondering what harm can it do to just leave it without using mysql_real_escape_string on that field knowing that title is already escaped and it's how the output is retrieved.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
如果有人在您的文本区域中输入此内容会发生什么。
如果您插入评论的查询类似于这样
，那么您就会遇到问题。生成的查询将是
or 以更易读的格式进行布局
，最后的 --' 只是创建一个注释，以消除任何可能导致其无法正确解析的额外 SQL。
What would happen if someone typed this into your textarea.
If your query to insert the comment were something like
then you would have a problem. the resulting query would be
or to lay it out in a more readable format
the --' at the end just creates a comment, to get rid of any extra SQL that would make it not parse properly.
所有未转义的字符串都可用于注入 SQL。
All unescaped strings can be used to inject SQL.
如果有人在textarea中使用SQL注入，它会在数据提交到你的数据库时运行，这就是为什么你首先要逃避它。
If someone uses SQL injection in the textarea, it will run when the data is submitted to your database, which is why you escape it first.
逃避它。假设用户是发表评论的人，那么您很容易受到评论部分注入的攻击，该注入将在他们发布表单时执行，而不是请求查看评论。
Escape it. Assuming users are the ones posting comments, you are vulnerable from injection in the comment section, which would be executed one they post the form, not request to view the comment.
不要让该字段未转义。该字段与什么链接并不重要。当查询形成时，注入器可以返回密码字段等。
要真正清除任何使用 SQL 注入的尝试，您需要使用存储过程。如果您有权访问它，您应该使用 PDO。
DO NOT leave that field un-escaped. It doesn't matter what the field is being linked with. By the time the query is formed the injector can be returning password fields etc.
To really clear out ANY attempt at using sql injection you need to be using stored procedures. If you have access to it you should be using PDO.