blocks|key|506734|text|您可以检查您的var是否只包含数字字母，这意味着您的var必须采用您定义的格式。在将其插入到查询中之前|type|unstyled|depth|inlineStyleRanges|entityRanges|data|506735|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You can check if you var contain only letters of numbers, meaning you var mast be in you defined format.
before you insert it into the query

blocks|key|2126230|text|CodeIgniter的Active+Record方法会自动为您避开查询，以防止sql注入。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2126231|$this->db->select('*')->from('tablename')->where('var',+$val1);
$this->db->get();|code-block|syntax|javascript|2126232|或|2126233|$this->db->insert('tablename',+array('var1'=>$val1,+'var2'=>$val2));|2126234|如果你不想使用活动记录，你可以使用query+bindings来防止注入。|2126235|$sql+=+'SELECT+*+FROM+tablename+WHERE+var+=+?';
$this->db->query($sql,+array($val1));|2126236|或者，对于插入，可以使用insert_string()方法。|style|CODE|2126237|$sql+=+$this->db->insert_string('tablename',+array('var1'=>$val1,+'var2'=>$val2));
$this->db->query($sql);|2126238|如果您更喜欢运行自己的查询，也可以使用escape()方法。|2126239|$val1+=+$this->db->escape($val1);
$this->db->query("SELECT+*+FROM+tablename+WHERE+var=$val1");|2126240|entityMap|0|LINK|mutability|MUTABLE|url|https://www.codeigniter.com/userguide2/database/active_record.html|1|https://www.codeigniter.com/userguide2/database/queries.html|2|https://www.codeigniter.com/userguide2/database/helpers.html|3^0|C|D|0|0|0|0|0|H|E|1|0|0|C|F|C|F|2|0|0|J|8|J|8|3|0|0^^$0|@$1|2|3|4|5|6|7|1D|8|@]|9|@$A|1E|B|1F|1|1G]]|C|$]]|$1|D|3|E|5|F|7|1H|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|1I|8|@]|9|@]|C|$]]|$1|K|3|L|5|F|7|1J|8|@]|9|@]|C|$G|H]]|$1|M|3|N|5|6|7|1K|8|@]|9|@$A|1L|B|1M|1|1N]]|C|$]]|$1|O|3|P|5|F|7|1O|8|@]|9|@]|C|$G|H]]|$1|Q|3|R|5|6|7|1P|8|@$A|1Q|B|1R|S|T]]|9|@$A|1S|B|1T|1|1U]]|C|$]]|$1|U|3|V|5|F|7|1V|8|@]|9|@]|C|$G|H]]|$1|W|3|X|5|6|7|1W|8|@$A|1X|B|1Y|S|T]]|9|@$A|1Z|B|20|1|21]]|C|$]]|$1|Y|3|Z|5|F|7|22|8|@]|9|@]|C|$G|H]]|$1|10|3|-4|5|6|7|23|8|@]|9|@]|C|$]]]|11|$12|$5|13|14|15|C|$16|17]]|18|$5|13|14|15|C|$16|19]]|1A|$5|13|14|15|C|$16|1B]]|1C|$5|13|14|15|C|$16|19]]]]

CodeIgniter's <a href="https://www.codeigniter.com/userguide2/database/active_record.html" rel="noreferrer">Active Record</a> methods automatically escape queries for you, to prevent sql injection.

<pre><code>$this-&gt;db-&gt;select('*')-&gt;from('tablename')-&gt;where('var', $val1);
$this-&gt;db-&gt;get();
</code></pre>

or

<pre><code>$this-&gt;db-&gt;insert('tablename', array('var1'=&gt;$val1, 'var2'=&gt;$val2));
</code></pre>

If you don't want to use Active Records, you can use <a href="https://www.codeigniter.com/userguide2/database/queries.html" rel="noreferrer">query bindings</a> to prevent against injection.

<pre><code>$sql = 'SELECT * FROM tablename WHERE var = ?';
$this-&gt;db-&gt;query($sql, array($val1));
</code></pre>

Or for inserting you can use the <a href="https://www.codeigniter.com/userguide2/database/helpers.html" rel="noreferrer"><code>insert_string()</code></a> method.

<pre><code>$sql = $this-&gt;db-&gt;insert_string('tablename', array('var1'=&gt;$val1, 'var2'=&gt;$val2));
$this-&gt;db-&gt;query($sql);
</code></pre>

There is also the <a href="https://www.codeigniter.com/userguide2/database/queries.html" rel="noreferrer"><code>escape()</code></a> method if you prefer to run your own queries.

<pre><code>$val1 = $this-&gt;db-&gt;escape($val1);
$this-&gt;db-&gt;query("SELECT * FROM tablename WHERE var=$val1");
</code></pre>

blocks|key|506831|text|您可以使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|506832|$this->db->escape()|code-block|syntax|javascript|506833|方法..|506834|$sql+=+"INSERT+INTO+table+(title)+VALUES(".$this->db->escape($omgomg).")";|506835|此处列出了其他方法。|506836|http://codeigniter.com/user_guide/database/queries.html|offset|length|506837|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|0|0|0|1J|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Y|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Z|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|10|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|11|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|12|8|@]|9|@$O|13|P|14|1|15]]|A|$]]|$1|Q|3|-4|5|6|7|16|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|N]]]]

you can use 

<pre><code>$this-&gt;db-&gt;escape()
</code></pre>

method..

<pre><code>$sql = "INSERT INTO table (title) VALUES(".$this-&gt;db-&gt;escape($omgomg).")";
</code></pre>

other methods are listed here.

<a href="http://codeigniter.com/user_guide/database/queries.html" rel="noreferrer">http://codeigniter.com/user_guide/database/queries.html</a>

blocks|key|4200125|text|您应该尽量避免将查询直接写入字符串，然后将它们传递给查询函数。更好的选择是使用Active+Record类，它将为您构建查询并转义值。http://codeigniter.com/user_guide/database/active_record.html|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4200126|如果您出于某种原因想要避免使用活动记录类，那么您可以查看数据库类的Codeigniter文档，该文档提供了一个转义方法，用于在将值传递给query方法之前对其进行转义。http://www.codeignitor.com/user_guide/database/queries.html|4200127|本|4200128|entityMap|0|LINK|mutability|MUTABLE|url|http://codeigniter.com/user_guide/database/active_record.html|1|http://www.codeignitor.com/user_guide/database/queries.html^0|1V|1P|0|0|2C|1N|1|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]]|C|$]]|$1|F|3|G|5|6|7|Z|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]|P|$5|K|L|M|C|$N|Q]]]]

You should try to avoid writing your queries directly into a string and then passing them to the query function. A better option would be to use the Active Record class which will build your queries for you and escape the values. <a href="http://codeigniter.com/user_guide/database/active_record.html" rel="nofollow">http://codeigniter.com/user_guide/database/active_record.html</a>

If you want to avoid using the Active Record class for whatever reason then you can view the Codeigniter documentation for the database class which has an escape method for escaping your values before passing them to the query method. <a href="http://www.codeignitor.com/user_guide/database/queries.html" rel="nofollow">http://www.codeignitor.com/user_guide/database/queries.html</a>

Ben

blocks|key|2126342|text|在接受来自客户端的值时，最好使用以下代码：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2126343|$client+=+$this->input->post('client',TRUE);|code-block|syntax|javascript|2126344|在插入时更好地使用码元插入方法，|2126345|$this->db->insert('tablename',$values);|2126346|当使用这个方法时，codeingniter会自动完成所有的转义操作，所以我们不需要手动转义。|2126347|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

While accepting value from client side, Better to use this code,

<pre><code>$client = $this-&gt;input-&gt;post('client',TRUE);
</code></pre>

While inserting better to use codeigniter inserting method,

<pre><code>$this-&gt;db-&gt;insert('tablename',$values);
</code></pre>

When using this method codeingniter automatically do all escape so we no need do escape manual.

blocks|key|2126373|text|在CodeIgniter中:有两个动作可以防止SQL注入。对于那些web编程新手来说，web编程中的另一种安全漏洞可能是致命的，因为它会暴露应用程序数据库的内部，那就是SQL注入。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2126374|同样值得庆幸的是，Codeigniter有能力处理它。但不幸的是，我合作的许多CI程序员(甚至您)确实(或可能)忘记了这两个操作，以防止任何情况下的SQL注入。|2126375|坚持使用ActiveRecord功能第一件事是在任何情况下都不要使用full+query来查询数据，如下所示：|2126376|$this->db->query("select+*+from+users+where+user=$user+and+password=$password")|code-block|syntax|javascript|2126377|当涉及到故意做错误事情的用户时，您不知道$user或$password+variable中的确切内容。即使是XSS+sanitiser也不会处理那些在其中输入引号、分号或破折号组合的人。因此，在这种情况下，您需要学习活动记录这件事，因为它具有专用于防止SQL注入的输入杀毒功能。不用担心，它支持如下类型的函数链接：|offset|length|style|BOLD|2126378|$this->db->select('title')->from('mytable')->where('id',+$id)->limit(10,+20);

$query+=+$this->db->get();|2126379|但请记住，如果你仍然像这样在活动记录函数中组合通常的(部分)查询函数，那么它将不起作用：|2126380|$query+=+$this->db->where("title+LIKE+'%25$input%25'");|2126381|它实际上可以像这样改变。|2126382|$query+=+$this->db->like("title",+$input);|2126383|重点是，使用CodeIgniter的活动记录的每一点可能性，并且不要弄乱它。|2126384|但是如果这不起作用，如果您有一个非常长的查询，并且不费心将其转换为活动记录的样式，那么还有一个替代方法，您可以使用此函数手动清理您的输入：|2126385|$sanitised_title+=+$this->db->escape($title);|2126386|//用于在LIKE查询中使用|2126387|$sanitised_title+=+$this->db->escape_like_str($title);|2126388|而且，您可以在查询中安全地连接已清理/转义的输入。|2126389|entityMap^0|0|0|0|0|K|F|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1F|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1G|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|1H|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|1I|8|@$M|1J|N|1K|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|H|7|1L|8|@]|9|@]|A|$I|J]]|$1|S|3|T|5|6|7|1M|8|@]|9|@]|A|$]]|$1|U|3|V|5|H|7|1N|8|@]|9|@]|A|$I|J]]|$1|W|3|X|5|6|7|1O|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|H|7|1P|8|@]|9|@]|A|$I|J]]|$1|10|3|11|5|6|7|1Q|8|@]|9|@]|A|$]]|$1|12|3|13|5|6|7|1R|8|@]|9|@]|A|$]]|$1|14|3|15|5|H|7|1S|8|@]|9|@]|A|$I|J]]|$1|16|3|17|5|6|7|1T|8|@]|9|@]|A|$]]|$1|18|3|19|5|H|7|1U|8|@]|9|@]|A|$I|J]]|$1|1A|3|1B|5|6|7|1V|8|@]|9|@]|A|$]]|$1|1C|3|-4|5|6|7|1W|8|@]|9|@]|A|$]]]|1D|$]]

In CodeIgniter: 
There are 2 action to prevent SQL Injection.
For those who are novelty in web programming, another kind of security hole in web programming which can be fatal because it can expose your inner side of application’s database, it is SQL Injection.

And thankfully again, Codeigniter has capability to deal with it. But unfortunately, many of CI programmer I collaborated (and even you) did (or might) forget this two action to prevent any circumstances of SQL injection.

Stick with ActiveRecord capability 
The first thing is do not in any circumstances dealing with querying the data by using full query like this :

<pre><code>$this-&gt;db-&gt;query("select * from users where user=$user and password=$password")
</code></pre>

You don’t know what exactly inside $user or $password variable when it comes to user who will do deliberately the wrong thing. Even XSS sanitiser won’t deal with someone who inputs combination of quote, semicolon or dash character in it.
So in this case, you need to learn this Active Record thing because it has input sanitiser capability dedicated to prevent SQL injection. And don’t worry, it support kind of function chaining like this :

<pre><code>$this-&gt;db-&gt;select('title')-&gt;from('mytable')-&gt;where('id', $id)-&gt;limit(10, 20);

$query = $this-&gt;db-&gt;get();
</code></pre>

But remember, it won’t work if you still do combining usual (partially) query function inside of active record function like this :

<pre><code>$query = $this-&gt;db-&gt;where("title LIKE '%$input%'");
</code></pre>

Which actually could be changed like this.

<pre><code>$query = $this-&gt;db-&gt;like("title", $input);
</code></pre>

The point is, use every bit of possibility of CodeIgniter’s Active Record and don’t mess with it.

But If that ain’t work, there is an alternative 
If you have a very long query and don’t bother to convert it to Active Record’s style, you can sanitised your input manually by using this function :

<pre><code>$sanitised_title = $this-&gt;db-&gt;escape($title);
</code></pre>

// For use inside LIKE query

<pre><code>$sanitised_title = $this-&gt;db-&gt;escape_like_str($title);
</code></pre>

And you can safely concatenate the sanitised/escaped input inside your query.

blocks|key|2409044|text|CodeIgniter提供了内置的函数和库来防止这种情况：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2409045|$this->db->escape();|code-block|syntax|javascript|2409046|此函数自动在数据两边添加单引号，并确定数据类型，以便它只能转义字符串数据。|2409047|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

CodeIgniter provides inbuilt functions and libraries to prevent this :
<pre><code>$this-&gt;db-&gt;escape();
</code></pre>
This function automatically adds single quotes around the data and determines the data type so that it can escape only string data.

In CodeIgniter, how can I avoid sql injection? Is there any method to set in config file to avoid sql injection? I am using this code for selecting values:

<pre><code>$this-&gt;db-&gt;query("SELECT * FROM tablename WHERE var='$val1'");
</code></pre>

and this for inserting values:

<pre><code>$this-&gt;db-&gt;query("INSERT INTO tablename (`var1`,`var2`) VALUES ('$val1','$val2')");
</code></pre>

Another method used to insert and select values from the database is CodeIgniter's <code>insert()</code> and <code>get()</code> methods. Is any chance to sql injection while using CodeIgniter's bulit-in functions

how to avoid sql injection in codeigniter

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

在CodeIgniter中，如何避免sql注入？有没有什么方法可以在配置文件中设置来避免sql注入？我使用下面的代码来选择值：$this->db->query("SELECT * FROM tablename WHERE var='$val1'");这是用于插入值的：$this->db->query("INSERT I...

问如何在codeigniter中避免sql注入
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在codeigniter中避免sql注入EN