SQL注入时我应该注意的符号
我知道你可以用mysql_real_escape_string()（以及htmlspecialchars()）解决所有问题，但我想知道导致所有这些混乱的符号，每个人都想知道摆脱？
这里的问题是，我们必须将不是我们构建的网站从一台主机转移到另一台主机。
它是从头开始编码的，以利用 php 现已弃用且从未被喜爱的 - magic_quotes。
主机更改后，php.ini 也发生了更改，我们遇到了很多意想不到的结果。我们无法访问 php.ini，没有 user.ini (5.2.x)，并且主机响应速度不够快，无法为我们提供一些额外功能。拉脱维亚的托管服务存在一个主要问题。
但是，是的，这已经是题外话了。我只是想知道，哪些符号是那些没有转义、没有魔法引号和没有保护的符号会导致所有这些混乱？
另外，当文本包含类似于 UNIX（主机操作系统）目录列表命令的内容时，会出现错误 - /ls - 方法未实现。
看起来网站是在 CLI 环境下与数据库交互的，因此出现了 /ls 问题。我想确认，每当您输入以 / 开头并遵循 UNIX 命令的值时，就会出现“方法未实现”错误。
PS：我不是在寻找解决方案，我已经修复了错误。只是想知道符号。
更新以澄清
1）在编写问题时，我正在调用 CLI ，看起来是 socket 调用 - unix-domain / TCP。活到老，学到老！
2）如果你完整地阅读了这个问题，你会发现我正在修复其他开发人员留下的错误/漏洞。既然我们接管了该客户的 IT 服务，他们也希望我们接管他们的网站。
3) 因为他们已经为当前网站支付了很多钱，所以他们不想为更新、构建更好的系统上的新网站支付更多费用。
4) 脚本内的连接行是 - $this->db = DB::connect('mysql://'._DB_USER.':'._DB_PASS.'@'._DB_HOST.'/'。 _DB_NAME.''); - unix-domain 我猜。
I know that you cure all of the stuff with mysql_real_escape_string() (and with htmlspecialchars()), but I want to know the symbols that cause all this mess everyone wants to get rid of?
The thing here is, that we here had to transfer a website not built by us from one host to another.
It has been coded from ground up, to utilize php's now deprecated and never loved one - magic_quotes.
After the host change there have been php.ini changes also, we encountered a lot of unexpected results. We don't have access to php.ini, there is no user.ini (5.2.x) and the host is is not responsive enough to enable us some extra features. There is a problem with hosting services here in Latvia, a major one.
But yeah, that's off-topic already. I simply want to know, which symbols are the ones that with no escaping, no magic quotes and no protection can cause all this mess?
Plus, there were error when text contained stuff like - /ls which resembles UNIX (the host OS) directory listing command - Method Not Implemented.
And it looks like the website interacts with database in CLI environment, hence the /ls problem. And I want to confirm that whenever you input a value that starts with / and follows UNIX command- "Method Not Implemented" errors comes up.
P.S. I'm not looking for a solution, I've already fixed the error. Just want to know the symbols.
Update to clarify
1) As of writing the question, I was calling CLI what looks to be socket call- unix-domain / TCP. Live and learn!
2) If you read the question fully, you'll see that I'm fixing bugs/holes left behind other developers. Sine we took over this clients IT servicing, they wanted us to take over their website too.
3) Because they have paid a lot of money for current website, they don't want to pay even more for a new one on a newer, better built system.
4) The connection line inside the scripts is - $this->db = DB::connect('mysql://'._DB_USER.':'._DB_PASS.'@'._DB_HOST.'/'._DB_NAME.''); - unix-domain I guess.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
来自 PHP 手册：
From the PHP Manual:
每个数据库都有自己的元字符作为标准 SQL 语法的扩展。有些会使用
--进行注释，有些会使用 c 风格的/* */等...每个 DB 都有自己的转义要求，这就是为什么有转义PHP 中每种数据库类型的函数。对 MySQL 有效的方法可能对（比如说）Oracle 完全没用。唯一的“最终”字符列表将是 SQL 标准中列出的字符。但是，仅在您自己的自定义转义函数中使用这些字符是没有用的，因为它不会包含数据库可以理解的特定于数据库的非标准元字符。
Each DB will have its own metacharacters as extensions to standard SQL syntax. Some will use
--for comments, some use c-style/* */, etc... Each DB has its own escaping requirements, which is why there's an escape function for every DB type in PHP. What works for MySQL may be completely useless for (say) Oracle.The only "definitive" list of characters will be the ones listed in the SQL standards. But using only those in your own custom escape function would be useless, because it won't include the DB-specific non-standard metacharacters that the DB understands.