PHP 的 mysql_real_escape_string 和 MySQL 注入
我一直在试图弄清楚 \x00、\n、\r、\ 或 \x1a 到底是如何导致 SQL 注入的（正如 https://www.php.net/manual/en/function.mysql-real-escape -string.php)
我理解单引号和双引号的概念，但是我如何以及为什么需要处理其他项目以使我的查询安全？
I have been trying to figure out how exactly \x00, \n, \r, \, or \x1a can cause an SQL Injection (as it is mentioned at https://www.php.net/manual/en/function.mysql-real-escape-string.php)
I understand the idea of single quote and double quotes, but how and why I need to take care of the other items to make my query safe?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我想知道同样的问题，我在 MySQL的C API文档，它指出：
字符串文字中还解释了：
NUL字符在C语言中表示字符串的结束，因此这可以错误地终止mysql客户端程序的输入参数。对于
\x1a也是如此，它在 Windows 下标记文件结尾（尝试在命令提示符中使用\x1a键入 test.txt > 文件中间的字符）。主要的一点是，如果管理员的日志文件阅读器未显示超出这些字符之一的数据，则管理员可能会错过日志文件中的重要信息。但谁还在 Windows 下使用不稳定的
type命令或等效命令来读取日志文件呢？换句话说，PHP 中的
\n、\r、\0或\x1a没有危险，除了可能使日志文件难以阅读之外。至于反斜杠，如果没有转义的话，\' OR 1==1将被转换为\\' OR 1==1，从而取消了反斜杠的效果转义引用。
I was wondering about the same question and I found the answer in the C API documentation of MySQL, it states:
It is also explained in String Literals that:
The NUL character represents the end of a string in C language, so this can falsely terminate the input argument of the mysql client program. Same thing for
\x1a, it marks the end-of-file under Windows (trytype test.txtin a command prompt with a\x1acharacter in the middle of the file).The main point is that an admin can miss important information in a log file if his log file reader doesn't show the data beyond one of these characters. But who still uses precarious
typecommand or equivalent under Windows to read a log file anyway?In other terms, there is no danger with
\n,\r,\0or\x1ain PHP, other than potentially making a log file difficult to read.As for the backslash, \' OR 1==1 would be converted to \\' OR 1==1 if it was not escaped too, cancelling the effect of the escaping of the quote.
假设您有
\ -> \：
尝试
\' 或 1=1； --'，转义引号后，您将得到\\' 或 1=1； --'并且 SQL 将是select * from mytable where myfield='\\' or 1=1; --'\x00
对于 PHP 来说不重要，但是对于 C 来说
抱歉，太懒了。
let's assume you have
\ -> \:
try
\' or 1=1; --', after escaping the quote, you would get\\' or 1=1; --'and the SQL would beselect * from mytable where myfield='\\' or 1=1; --'\x00
Not important for PHP, but for C
Sorry, too lazy for the rest.