相关疑难解决方法(0)

在http://www.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/?akst_action=share-this上,有一节声称可以绕过某些亚洲字符编码的mysql_real_escape_string

用BIG5或GBK绕过mysql_real_escape_string()

"注入字符串"
に关する追加情报:

上面的字符是中文Big5

这是真的吗？如果是这样,如果您无法访问预先准备好的声明,您将如何保护您的网站不受此影响？

我写了这个简短的函数来防止my_sql注入,因为它的重要性我只想与其他人仔细检查这将按照我的意图运行.

foreach($_REQUEST as $key => $value) {          
    $_REQUEST[$key] = stripslashes($value);
    $_REQUEST[$key] = mysql_real_escape_string($_REQUEST[$key]);
} 

include "../admin/site.php"; // Setup db connection.

$appid = -1;
if (is_string($_GET["id"]))
{
    $id = mysql_real_escape_string($_GET["id"]);
    $sql = "select * from version where id=$id";
    $ver = mysql_query($sql);
    if ($id > 0 && $ver && mysql_num_rows($ver))
    {
        $appid = mysql_result($ver, 0, "AppID");
        $app = DLookUp("apps", "name", "id=$appid");
        $name = mysql_result($ver, 0, "Name");
        $notes = mysql_result($ver, 0, "Notes");
    }
    else $app = "No version by that ID";
}
else $app = "No ID";

/* some html snipped */

if (isset($app) && isset($name))
    echo …