如何保护我的网站免受SQL注入攻击?我使用
PHP和MySQL.我必须改变我的mysql查询吗?
例如,我有一个这样的查询:
$q=$_GET["q"];// im getting the Q value from the other form,from drop down box[displaying data using Ajax
$a1=$_POST['hosteladmissionno'];
$a2=$_POST['student_name'];
$a3=$_POST['semester'];
$con = mysql_connect('localhost', 'root', '');
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("hostel", $con);
$a1="SELECT hosteladmissionno,student_name,semester FROM registration
WHERE mess_type ".$q."' AND status_flag=1";
$result = mysql_query($a1);
if ($result === false) {
die(mysql_error());
}
echo "
S.No | H.Admin No | Student Name | No of Days |
---|
$i=0;
while($row = mysql_fetch_array($result))
{
$i=$i+1;
echo "
";echo "
" .$i."";echo "
" . $row['hosteladmissionno'] . "";echo "
" . $row['student_name'] . "";echo "
";echo "
";}
echo "
";mysql_close($con);
?>
我是否必须在查询中包含任何更改以避免注入攻击?任何建议都会有所帮助.谢谢.干杯!