PHP＆amp; SQL：保护此查询免受不使用PDO的SQL注入的最佳方法

Question

我有一个针对mssql数据库运行的查询，我没有使用PDO驱动程序。是否有可以使用的准备好的陈述？

以下是查询：

$tsql = "INSERT INTO cplinktable (liferayid, bmsid, autotaskid, waspdb, cpid) VALUES ($liferayid, $bmsid, $autotaskid, '$waspdb', $cpid)";

感谢，

Jonesy

Answer 1

用于PHP的Microsoft SQL驱动程序提供了预准备语句：

• http://www.microsoft.com/downloads/en/details.aspx?FamilyID=80e44913-24b4-4113-8807-caae6cf2ca05&displaylang=en
• http://msdn.microsoft.com/en-US/library/cc296184%28v=SQL.90%29.aspx

Answer 2

你至少应该逃避这些价值观。

PHP Manual - mysql_real_escape_string

Answer 3

$query = sprintf("INSERT INTO cplinktable (liferayid, bmsid, autotaskid, waspdb, cpid) VALUES ('%s','%s','%s','%s','%s')",
            mysql_real_escape_string($liferavid),
            mysql_real_escape_string($bmsid),
            mysql_real_escape_string($autotaskid),
            mysql_real_escape_string($waspdb),
            mysql_real_escape_string($cpid));

Answer 4

就像在字符串上使用mysql_real_escape和在数字/整数/双打上进行类型转换一样简单

(int)$number; //Safe
(double)$double; //Safe
mysql_real_escape_string($string); //Safe

用于插入数据库的每一条数据都是安全的

Answer 5

尝试使用sprint()

准备语句

$tsql = "INSERT INTO cplinktable (liferayid, bmsid, autotaskid, waspdb, cpid) VALUES (%d, %d, %d, '%s', %d)";

$tsql = sprintf($tsql, $liferayid, $bmsid, $autotaskid, $waspdb, $cpid);
echo $tsql; // you would execute this but printing to the screen to show the query