blocks|key|4638442|text|这取决于您的查询；如果您只讨论要在数据库中插入的值，mysql_real_escape_string就足够了，您不需要addslashes。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4638443|如果您还在讨论变量表或列的名称，那么您将需要使用白名单，并且mysql_real_escape_string将不会阻止在这些列表上进行sql注入。|4638444|所以答案实际上是：不，这取决于你的查询。|BOLD|4638445|entityMap^0|Q|O|1N|A|0|U|O|0|9|A|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]|$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|U|8|@$9|V|A|W|B|J]]|D|@]|E|$]]|$1|K|3|-4|5|6|7|X|8|@]|D|@]|E|$]]]|L|$]]

It depends on your query; if you are talking about just the values you want to insert in your database, <code>mysql_real_escape_string</code> is enough, you don´t need <code>addslashes</code>.

If you also are talking about variable table or column names, you'll need white-lists as well as <code>mysql_real_escape_string</code> will not prevent sql injection on these.

So the answer really is: No, it depends on your query.

blocks|key|2564309|text|根本不要使用addslashes；它不适合防止SQL注入。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2564310|仅使用mysql_real_escape_string。如果需要更改字符编码，请使用mysql_set_charset。|2564311|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/addslashes|1|http://php.net/mysql_real_escape_string|2|http://php.net/mysql_set_charset^0|6|A|6|A|0|0|3|O|16|H|3|O|1|16|H|2|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]]|D|@$9|W|A|X|1|Y]]|E|$]]|$1|F|3|G|5|6|7|Z|8|@$9|10|A|11|B|C]|$9|12|A|13|B|C]]|D|@$9|14|A|15|1|16]|$9|17|A|18|1|19]]|E|$]]|$1|H|3|-4|5|6|7|1A|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]|P|$5|K|L|M|E|$N|Q]]|R|$5|K|L|M|E|$N|S]]]]

Don’t use <a href="http://php.net/addslashes" rel="nofollow"><code>addslashes</code></a> at all; it’s not appropriate to protect against SQL injections.

Use <a href="http://php.net/mysql_real_escape_string" rel="nofollow"><code>mysql_real_escape_string</code></a> only. And if you need to change the character encoding, use <a href="http://php.net/mysql_set_charset" rel="nofollow"><code>mysql_set_charset</code></a>.

blocks|key|946930|text|没有任何简单的“神奇”方法来防止SQL注入。mysql_real_escape_string是一个很好的开始，使用PDO+(docs)更好。最重要的是，你需要看看你的数据库结构，看看你的查询，看看你的数据源，然后想清楚。数据从何而来？如果数据不是我所期望的，会发生什么？|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|946931|在创建代码的整个结构时，应该考虑到控制应用程序逻辑的流程。防止SQL注入的最好方法是保持对数据库中内容的感知和控制。|946932|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/book.pdo.php^0|M|O|1Q|4|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@$9|S|A|T|1|U]]|E|$]]|$1|F|3|G|5|6|7|V|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|W|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

There isn't any simple "magical" way to prevent SQL injection. <code>mysql_real_escape_string</code> is a good start, using PDO (<a href="http://php.net/manual/en/book.pdo.php" rel="nofollow">docs</a>) is even better. Above all of that, you need to look at your database structure, look at your queries, look at your data sources, then think it out. Where is data coming from? What would happen if the data isn't what I expect?

The entire structure of your code should be created with a mind toward controlling the flow of your application logic. The best way to prevent SQL injection is to stay aware and in control of what goes in your database.

blocks|key|2564285|text|您永远不应该使用addslashes。只需坚持使用mysql_real_escape_string|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2564286|无论如何，只有死亡是确定的。|2564287|如果你害怕死亡，你应该使用PDO来减少漏洞的发生。|2564288|http://it.php.net/manual/en/pdo.prepare.php|2564289|entityMap|0|LINK|mutability|MUTABLE|url^0|8|A|P|O|0|0|0|0|17|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|X|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|Y|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|Z|8|@]|D|@$9|10|A|11|1|12]]|E|$]]|$1|L|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|M|$N|$5|O|P|Q|E|$R|K]]]]

You should never use <code>addslashes</code>. Just stick with <code>mysql_real_escape_string</code>

Anyway only the death is sure.

And if you fear the death you should use PDO to be less prone to vulnerabilities

<a href="http://it.php.net/manual/en/pdo.prepare.php" rel="nofollow">http://it.php.net/manual/en/pdo.prepare.php</a>

blocks|key|4638502|text|我想，这要看你的意思了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4638503|如果没有其他原因，仅仅使用mysql_real_escape_string将不会100%25确定地保护您，因为它可能不正确地使用它。|4638504|另一方面，正确使用mysql_real_escape_string应该会尽可能地保护你。|4638505|另一方面，作为程序员，与参数化查询相比，使用mysql_real_escape_string可能更容易出错。|4638506|如果你不确定你的代码，也许发布它并特别询问它可能更有教育意义/更有用。|4638507|还有:其他人关于addslashes的说法也是如此。|4638508|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|R|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|S|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|M|$]]

Depends on what you mean, I suppose.

The mere use of mysql_real_escape_string will not protect you with 100% certainty, if for no other reason than that it is possible to use it incorrectly.

On the other hand, the correct use of mysql_real_escape_string should protect you as close to 100% as you can get. 

On yet some other hand, it is probably easier to make mistakes as a programmer using mysql_real_escape_string compared to a parameterized query.

If you are unsure about your code, perhaps posting it and asking about it specifically may be more educational/useful.

Also: Ditto what others are saying regarding addslashes.

If I'm using <code>mysql_real_escape_string</code> and <code>addslashes</code> to avoid sql Injection attack in my website is this two are enough to stop SQL Injection so its 100% sure no one can now attack using SQL Injection?

Sql injection prevention techniques still vulnerable?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

如果我在我的网站上使用mysql_real_escape_string和addslashes来避免sql注入攻击，这两个是否足以阻止SQL注入，所以它100%确定现在没有人可以使用SQL注入攻击？

问Sql注入预防技术仍然易受攻击？
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Sql注入预防技术仍然易受攻击？EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Sql注入预防技术仍然易受攻击？
EN