php sql注入攻击,php – SQL注入攻击

如何保护我的网站免受SQL注入攻击？我使用

PHP和MySQL.我必须改变我的mysql查询吗？

例如,我有一个这样的查询：

$q=$_GET["q"];// im getting the Q value from the other form,from drop down box[displaying data using Ajax

$a1=$_POST['hosteladmissionno'];

$a2=$_POST['student_name'];

$a3=$_POST['semester'];

$con = mysql_connect('localhost', 'root', '');

if (!$con)

{

die('Could not connect: ' . mysql_error());

}

mysql_select_db("hostel", $con);

$a1="SELECT hosteladmissionno,student_name,semester FROM registration

WHERE mess_type ".$q."' AND status_flag=1";

$result = mysql_query($a1);

if ($result === false) {

die(mysql_error());

}

echo "

S.No	H.Admin No	Student Name	No of Days

$i=0;

while($row = mysql_fetch_array($result))

{

$i=$i+1;

echo "

";

echo "

" .$i."";

echo "

" . $row['hosteladmissionno'] . "";

echo "

" . $row['student_name'] . "";

echo "

";

echo "

";

}

echo "

";

mysql_close($con);

?>

我是否必须在查询中包含任何更改以避免注入攻击？任何建议都会有所帮助.谢谢.干杯!