PHP和MySQL注入预防

Question

我已经用我的代码做了很多研究和准备,试图阻止SQL注入,但我想讨论一些我不太确定的事情.

我理解mysqli_real_escape_string不会转义_(下划线)和%(百分号)字符.如果我在我的SQL语句中没有使用任何LIKE子句,这是否会让我面临任何风险？

下面是我有兴趣谈论的一个例子.这是我正在使用的登录脚本.我想确保我不会在这里打开任何注射漏洞.非常感谢您的见解和反馈.

// Initiate login process if the mode is set to login
if ($_REQUEST['mode'] == "login") {

    // Open shared database connection
    $cxn = connectDb();

    // Escape characters to help prevent a SQL injection attack
    $username = mysqli_real_escape_string($cxn, $_POST['user']);

    // Convert submitted password to hashed value using 
    // custom password hashing function
    $password = custompwhash($_POST['pass']);

    // Execute SQL statement to determine if the credentials provided 
    // match a valid user
    $sql = "SELECT count(*) as countOK FROM user_def WHERE ".
            "username = '$username' AND password = '$password'";
    $result = mysqli_query($cxn,$sql);
    $row = mysqli_fetch_array($result);
    extract($row);

    // If the username value submitted is null, throw and error
    if ($username == "") {
        die2("Please enter your username and try again.<br />");
        failedloginalert($username);
    }

    // If the password value submitted is null, throw and error
    else if ($password == "") {
        die2("Please enter your password and try again.<br />");
        failedloginalert($username);
    }

    // If the credenetials provided match a valid user in the database, 
    // initate login
    else if ($countOK == '1') {    
        $sql2 = "INSERT INTO `user_activity` (`username`, `time`, `ip`)".
                " VALUES ('$username', NOW(), '{$_SERVER['REMOTE_ADDR']}')";
        $result2 = mysqli_query($cxn,$sql2);
        $_SESSION['auth'] = 1;
        $_SESSION['username'] = $username;

        // If the user does not need to be directed to a specific page, direct to home.php
        if (empty($_GET['page'])) {
            die2("<span style='color:#000;'>You have successfully logged in. <br /><br />
            Please click <a href=\"/admin/home.php\">here</a> if you are not automatically redirected.</span>
            <meta http-equiv='refresh' content='0;url=home.php'/>");
            die();
        }

        // Otherwise, if the user does need to be directed to a specific page, direct to the requested page
        else {
            $loginredirectpage = $_GET['page'];
            die2("<span style='color:#000;'>You have successfully logged in. <br /><br />
            Please click <a href=\"/admin/home.php\">here</a> if you are not automatically redirected.</span>
            <meta http-equiv='refresh' content='0;url=".$loginredirectpage."'/>");
            die();
        }
    }

    // Since the credenetials provided do not match a valid user in the database, throw an error
    else { 
        die2("The username or password you entered is invalid. Please try again. <br/><br/>If the problem persists, <a href=\"/user/resetpassword.php\" class=\"red\">reset your password</a>.");
        failedloginalert($username); 
    }
}

Answer 1

开始使用PDO和Prepared Statements,您的SQL注入问题将会消失.