如何在没有 mysql 的情况下清理 php 输入
我正在尝试找出一种方法来清理从 php 进入 sqlite 的输入。我无法使用mysql。仅仅使用 sqlite_escape_string 就足够了还是我需要做其他事情？另外我只能使用sqlite2。
I am trying to figure out a way to sanitize input going into sqlite from php. I cannot use mysql. Is it enough to simply use sqlite_escape_string or do I need to do anything else? Also I can only use sqlite2.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
避免 SQL 注入的最佳方法是强制使用参数查询，并且永远不要通过字符串连接或变量插值手动组装 SQL 语句。
在 PHP 5+ 上，您可以使用 PDO，它是一个多数据库抽象层，支持 SQLite（以及其他）和参数查询。
The best way to avoid SQL injection is to enforce the use of parametric queries, and never ever manually assemble SQL statements by string concatenation or variable interpolation.
On PHP 5+, you may use PDO, which is a multi-database abstraction layer supporting (among others) SQLite, and parametric queries.
转义函数确保 SQL 方言使用的特殊字符（主要是引号）被转义，以便您的插入/更新等工作。 sqlite_escape_string 所做的只是转义单引号。
此外，人们还担心有人可以制造 SQL 注入。因为您使用的是 v2，所以您无法使用可以保护您的prepare 和 _bind() 函数。
SQLite 允许您链接由“;”分隔的命令所以那里有一个问题。我建议您首先使用您编写的辅助函数或使用 sprintf 仔细设计参数，并确保正确输入整数、浮点数和字符串。
您应该能够创建自己的转义函数来“转义”您想要注意的内容...最具体的是分号，在查询末尾使用 ... ESCAPE '\' ，假设您使用反斜杠作为你的逃脱角色。
然后就会出现有人故意插入恶意内容（XSS）的问题。 Grigor 提供了一种解决方案——在字符串上使用 htmlentities() 。
Escape functions make sure that the special characters (quotes mainly) that are used by the SQL dialect are escaped, so that your inserts/updates etc work. All sqlite_escape_string does is escape single quotes.
Then there is the substantial concern that someone can craft an SQL injection. Because you're using v2, you can't use the prepare and _bind() functions that would protect you.
SQLite lets you chain commands seperated by ';' so there is an issue there. I would suggest you start by carefully crafting your parameters using either helper functions you write or using sprintf and insure that you are typing your ints, floats, and strings appropriately.
You should be able to create your own escape function that "escapes" things you want to watch out for... most specifically the semicolon, using the ... ESCAPE '\' at the end of your queries, assuming you utilize the backslash as your escape character.
Then you have the issue of someone intentionally inserting malicious content (XSS). Grigor provided one solution -- use htmlentities() on your strings.
有很多方法，但这取决于您输入的目标，请参阅此问题以更好地理解它： 使用 PHP 清理用户输入的最佳方法是什么？
There are ways, but it depends on the target of your input, Please refer to this question to understand it better: What's the best method for sanitizing user input with PHP?
sqlite_escape_string()应该完成所有操作您需要输入字符串进行清理。至于输出，如果是输出为HTML，则使用htmlspecialcharts( )在输出之前。sqlite_escape_string()should do all the sanitizing you need to input the string. As for outputting it, if it's being outputted into HTML, then usehtmlspecialcharts()on it before outputting it.SQLite 提供
sqlite_escape_string()那。不过，它仅适用于 PHP 5。不过，仅仅依靠这些方法并不能帮助您免于注射。一个必要的措施是始终首先验证用户提供的输入，然后再将其置于您必须依赖但实际上尚未创作的方法之前。
SQLite offers
sqlite_escape_string()for that. It's only available for PHP 5, though.Solely relying on these methods will not save you from injections, though. An imperative measure is to always validate user-provided input first, before subjecting it to methods, you have to rely on - but actually haven't authored.