問題描述
我目前正在使用 mysqli php 擴展.
I'm currently using the mysqli php extension.
傳統上我使用 mysqli_real_escape_string 來轉義用戶輸入.但是，我正在考慮更改代碼(希望以盡可能少的步驟)以使用準備好的語句.
Traditionally I have used mysqli_real_escape_string to escape user input. However I am looking at changing over the code (hopefully in as few steps as possible) to use prepared statements.
我想清楚這一點 - 如果我使用準備好的語句來綁定我的所有變量，我可以確信 sql 注入是不可能的嗎?(并完全免除 mysqli_real_escape_string?)
I want to be clear on this - provided I use prepared statements to bind all of my variables, can I be confident that sql injection is impossible? (And dispense completely with mysqli_real_escape_string?)
謝謝
推薦答案
如果您正確綁定所有變量，您可以顯著降低 SQL 注入的風險.如果您動態創建 SQL，仍然有可能獲得 SQL 注入，例如:
If you correctly bind all your variables you can dramatically reduce the risk of SQL injection. It is still possible to get an SQL injection if you create SQL dynamically for example:
'SELECT * FROM ' . $tablename . ' WHERE id = ?'
但如果你避免這樣的事情，你就不太可能遇到問題.
But if you avoid things like this it is unlikely you will have problems.
這篇關于mysqli 準備好的語句和 mysqli_real_escape_string的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！