使用MySQLi将数据库与php连接的安全方法

Question

我只是将我的长代码缩减为小巧，以便于理解。我正在建立基于php的网站。我正在使用MySQLi，据我所知MySQL。对我来说PDO来说，很难在短时间内学习。

我创建了三个文件

 - db.con.php
 - index.php
 - logout.php

我将发布所有三个文件，我只想知道它是否safe存在Vulnerability

我感谢所有看到我的问题并非常感谢您回答的人。

db.con.php

<?php
//db.con.php
class DB { 
    protected $db_name = 'demo';
    protected $db_user = 'root';
    protected $db_pass = '';
    protected $db_host = 'localhost';

    public function connect() { 
        $DBerror = 'Database Error';
        $connection = ($GLOBALS["___mysqli_ston"] = mysqli_connect($this->db_host,  $this->db_user,  $this->db_pass)) or die($DBerror); 
        ((bool)mysqli_query($GLOBALS["___mysqli_ston"], "USE $this->db_name")) or die($DBerror); 
        return true; 
    }
} 

$db = new DB();
$db->connect();

//start session
session_start();
?>

index.php

<?php
require_once 'db.con.php';
$userID = $_GET['userID'];
$userID = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $userID);

$CheckQuery = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM users WHERE id='$userID'");

$VerifyID = mysqli_num_rows($CheckQuery);
if ($VerifyID !== 1){
    header("Location: logout.php");
}

while ($row = mysqli_fetch_assoc($CheckQuery)) {
    $id = $row['id'];
    $name = $row['name'];
}

echo "My id is $id and my name is $name";

?>

以及最后一个logout.php

<?php
//logout.php
session_start();

session_destroy();
echo "Logout successful";
?>

Answer 1

1. 使它成为PDO而不是mysqli
2. 暂时离开DB类
3. 学习准备好的陈述

db.con.php

<?php
$dsn = "mysql:host=localhost;dbname=demo;charset=utf8";
$opt = array(
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
);
$pdo = new PDO($dsn, 'root', '', $opt);

session_start();

index.php

<?php
require_once 'db.con.php';

$stmt = $pdo->prepare("SELECT 1 FROM users WHERE id=?");
$stmt->execute(array($_GET['userID']));
$row = $stmt->fetch();
if(!$row) {
    header("Location: logout.php");
    exit;
}
$id = $row['id'];
$name = $row['name'];
echo "My id is $id and my name is $name";

看起来没有自制包装就更好了