PHP 对 GET 参数的保护
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5089549/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
PHP protection of GET parameters
提问by benhowdle89
OK consider this url:
好的考虑这个网址：
example.com/single.php?id=21424
It's pretty obvious to you and i that the PHP is going to take the id and run it through a mysql query to retrieve 1 record to display it on the page.
对您和我来说很明显，PHP 将获取 id 并通过 mysql 查询运行它以检索 1 条记录以将其显示在页面上。
Is there anyway some malicious hacker could mess this url up and pose a security threat to my application/mysql DB?
是否有一些恶意黑客可能会弄乱这个 url 并对我的应用程序/mysql 数据库构成安全威胁？
Thanks
谢谢
回答by Intrepidd
Of course, never ever ever consider a user entry (_GET, _POST, _COOKIE, etc) as safe.
当然，永远不要认为用户条目（_GET、_POST、_COOKIE 等）是安全的。
Use mysql_real_escape_string php function to sanitize your variables: http://php.net/manual/en/function.mysql-real-escape-string.php
使用 mysql_real_escape_string php 函数来清理你的变量：http: //php.net/manual/en/function.mysql-real-escape-string.php
About SQL injections : http://en.wikipedia.org/wiki/SQL_injection
关于 SQL 注入：http: //en.wikipedia.org/wiki/SQL_injection
回答by greg0ire
All depends on the filtering you explicitely (with filter_var()for instance) or implictely (by using prepared statements for instance) use.
一切都取决于您显式（filter_var()例如）或隐式（例如使用准备好的语句）使用的过滤。
回答by Voooza
Well there is Sql injection http://en.wikipedia.org/wiki/SQL_injection
那么有 Sql 注入 http://en.wikipedia.org/wiki/SQL_injection
