如何安全地为 mysql 转义 php 中的输入数据
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/10380019/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to safely escape the input data in php for mysql
提问by frops
Which means, at the moment, are the safest for screening data in php to send them to the mysql database.
这意味着，目前，在 php 中筛选数据以将它们发送到 mysql 数据库是最安全的。
Thank, you )
谢谢 ）
回答by Mihai Iorga
I believe mysql_real_escape_string()mysqli_real_escape_string()is the best way to escape input data
我相信mysql_real_escape_string()mysql i_real_escape_string()是转义输入数据的最佳方式
Later edit since everything is deprecated now and information must be valid:
稍后编辑，因为现在一切都已弃用并且信息必须有效：
Try to use PDOas prepared statements are much safer or mysqli_*() functionsif you really need to keep old code somewhat up-to-date.
如果您确实需要使旧代码保持最新，请尝试使用PDO作为准备好的语句或mysqli_*() 函数更安全。
回答by Songo
Currently the most preferred way to insure your safety is prepared statements.
目前，确保您的安全的最优选方式是准备好的声明。
example:
例子：
$preparedStatement = $db->prepare('SELECT * FROM memebers WHERE username = :username');
$preparedStatement->execute(array(':username' => $username));
$rows = $preparedStatement->fetchAll();
then when displaying your data use htmlspecialchars()
然后在显示您的数据时使用 htmlspecialchars()
回答by user1260776
validMySQL($var) {
$var=stripslashes($var);
$var=htmlentities($var);
$var=strip_tags($var);
$var=mysql_real_escape_string($var);
return $var
}
The above code helps to sanitize most invalid data, just remember that you've to be connected to mysql database for mysql_real_escape_string to work...
上面的代码有助于清理大多数无效数据，请记住，您必须连接到 mysql 数据库才能使 mysql_real_escape_string 工作...
