Question

我正在创建一个CMS，但我不知道如何编写代码以从sql注入中保存，让我知道我的代码中是否存在sql注入漏洞。

    if(isset($_POST['cout'])){

        $servername = "localhost";
        $username = "root";
        $password = "";
        $db = "bangla";
        $con = new mysqli($servername, $username, $password, $db);
        mysqli_query($con, "SET CHARACTER SET utf8");
        mysqli_query($con, "SET SESSION collation collation='utf8_general_ci'");

        $id = NULL;

        $name = $_POST['name'];
        $name = strip_tags($name);
        $name = htmlentities($name);
        $name = mysqli_real_escape_string($con, $name);

        $distrct = $_POST['distrct'];
        $distrct = strip_tags($distrct);
        $distrct = htmlentities($distrct);
        $distrct = mysqli_real_escape_string($con, $distrct);

        $division = $_POST['division'];
        $distrct = strip_tags($division);
        $distrct = htmlentities($division);
        $distrct = mysqli_real_escape_string($con, $division);

        $stmt = $con->prepare("INSERT INTO couts (id, name, distrct, division) VALUES( ?,?,?,?)");
        $stmt->bind_param('ssss', $id, $name, $distrct, $division);
        if($stmt->execute()){
            echo "New record created successfully";
        }
    }

Answer 1

您不需要strip_tags()。

您不需要htmlentities()。

您不需要mysqli_real_escape_string()。

只需使用查询参数。

我的代码是否容易受到SQL注入攻击？

1 个答案: