防止sql注入

 

<?php
$mysql = new mysqli("localhost","root","","mysql_interface");
if(mysqli_connect_errno()){
    echo "连接数据库失败：".mysqli_connect_error();
    $mysqli=null;
    exit;
}
$username = $_POST['username'];
$password = $_POST['password'];

/*
*防止sql注入
*ss 规定不能使用除了字符串之外的任何数据类型
*/
$stmt = $mysql->prepare("select * from user where username =? and password=?");
$stmt->bind_param("ss",$username,$password);
$stmt->execute();
$result = $stmt->get_result();
/*
*以下代码能够被sql注入
*/
/*
$sql = "select * from user where username = '$username' and password = '$password'";
$result = $mysql->query($sql);
if (!$result) {
	echo "sql语句错误<br>";
	echo "error:".$mysql->error."|".$mysql->error;
    exit; 
}*/

if ($result->num_rows > 0) {
	echo "登陆成功";
}else{
	echo "登陆失败";
}
?>

 

转载于:https://my.oschina.net/strip/blog/1251607