blocks|key|1101421|text|最好的方法是使用Prepared+Statements|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1101422|entityMap|0|LINK|mutability|MUTABLE|url|http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html^0|8|J|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

The best way to go would be to use <a href="http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html" rel="nofollow noreferrer">Prepared Statements</a>

blocks|key|1316388|text|mysql_real_escape_string()仅用于防止SQL注入攻击。它不会帮助你防止跨站点脚本攻击。为此，您应该在输出最初从用户输入中收集的数据之前使用htmlspecialchars()。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1316389|entityMap^0|0|Q|29|I|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|M|8|@]|D|@]|E|$]]]|G|$]]

<code>mysql_real_escape_string()</code> is useful for preventing SQL injection attacks only. It won't help you with preventing cross site scripting attacks. For that, you should use <code>htmlspecialchars()</code> just before outputting data that was originally collected from user input.

blocks|key|1316440|text|有不同类型的“清洁”。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1316441|对于数据库数据，mysql_real_escape_string就足够了，但如果它是HTML语言，则浏览器在显示时仍将对其进行计算。|offset|length|1316442|要从用户输入中删除超文本标记语言，可以使用strip_tags。|1316443|我建议您考虑使用PDO而不是常规的MySQL内容，因为它支持开箱即用的预准备语句，并且可以为您处理无效数据的转义。|1316444|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.mysql-real-escape-string.php|1|http://php.net/manual/en/function.strip-tags.php|2|http://php.net/manual/en/book.pdo.php^0|0|8|O|0|0|L|A|1|0|8|3|2|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]]|A|$]]|$1|F|3|G|5|6|7|10|8|@]|9|@$D|11|E|12|1|13]]|A|$]]|$1|H|3|I|5|6|7|14|8|@]|9|@$D|15|E|16|1|17]]|A|$]]|$1|J|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]|R|$5|M|N|O|A|$P|S]]|T|$5|M|N|O|A|$P|U]]]]

There are different types of "cleaning".

<a href="http://php.net/manual/en/function.mysql-real-escape-string.php" rel="nofollow noreferrer">mysql_real_escape_string</a> is sufficient for database data, but will still be evaluated by the browser upon display if it is HTML.

To remove HTML from user input, you can use <a href="http://php.net/manual/en/function.strip-tags.php" rel="nofollow noreferrer">strip_tags</a>.

I would suggest you look into using <a href="http://php.net/manual/en/book.pdo.php" rel="nofollow noreferrer">PDO</a> instead of regular MySQL stuff, as it supports prepared statements right out of the box, and those handle the escaping of invalid data for you.

blocks|key|1316508|text|我想补充一句，PHP+5.2%2B具有输入过滤功能，可以通过各种方式过滤用户输入。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1316509|这是manual+entry以及Matt+Butcher的blog+post，讲述了为什么他们很棒。|offset|length|1316510|entityMap|0|LINK|mutability|MUTABLE|url|http://us2.php.net/manual/en/ref.filter.php|1|http://www.phparch.com/2010/07/08/never-use-_get-again/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%253A%2Bphpa%2B%2528php%7Carchitect%2BNews%2529&utm_content=Google%2BReader^0|0|2|C|0|T|9|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]|$D|U|E|V|1|W]]|A|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]|N|$5|I|J|K|A|$L|O]]]]

I thought I'd add that PHP 5.2+ has input filter functions that can sanitize user input in a variety of ways.

Here's the <a href="http://us2.php.net/manual/en/ref.filter.php" rel="nofollow noreferrer">manual entry</a> as well as a <a href="http://www.phparch.com/2010/07/08/never-use-_get-again/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+phpa+%28php|architect+News%29&amp;utm_content=Google+Reader" rel="nofollow noreferrer">blog post</a> [by Matt Butcher] about why they're great.

blocks|key|1316546|text|您可以同时尝试这两种方法，如|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1316547|function+clean_input($instr)+{

+++++//+Note+that+PHP+performs+addslashes()+on+GET/POST+data.
+++++//+Avoid+double+escaping+by+checking+the+setting+before+doing+this.
++++if(get_magic_quotes_gpc())+{
++++++++$str+=+stripslashes($instr);
++++}
++++return+mysql_real_escape_string(strip_tags(trim($instr)));
}|code-block|syntax|javascript|1316548|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can try both, as in

<pre><code>function clean_input($instr) {

 // Note that PHP performs addslashes() on GET/POST data.
 // Avoid double escaping by checking the setting before doing this.
 if(get_magic_quotes_gpc()) {
 $str = stripslashes($instr);
 }
 return mysql_real_escape_string(strip_tags(trim($instr)));
}
</code></pre>

Is <code>mysql_real_escape_string</code> sufficient for cleaning user input in most situations?

::EDIT::

I'm thinking mostly in terms of preventing SQL injection but I ultimately want to know if I can trust user data after I apply mysql_real_escape_string or if I should take extra measures to clean the data before I pass it around the application and databases. 

I see where cleaning for HTML chars is important but I wouldn't consider it necessary for trusting user input.

T

PHP: Is mysql_real_escape_string sufficient for cleaning user input?

SQL注入攻击

数据库

MySQL

在大多数情况下，mysql_real_escape_string是否足以清理用户输入？：：编辑：：我主要考虑防止SQL注入，但我最终想知道，在应用mysql_real_escape_string之后，我是否可以信任用户数据，或者在将数据传递给应用程序和数据库之前，是否应该采取额外措施来清理数据。我知道清理HTML字符很...

问mysql_real_escape_string是否足以清理用户输入？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问mysql_real_escape_string是否足以清理用户输入？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问mysql_real_escape_string是否足以清理用户输入？
EN