php mysql 参数化查询,php – 参数化查询

请问这段代码安全吗？

/* Create a new mysqli object with database connection parameters */

$mysqli = new mysql('localhost', 'username', 'password', 'db');

if(mysqli_connect_errno()) {

echo "Connection Failed: " . mysqli_connect_errno();

exit();

}

/* Create a prepared statement */

if($stmt = $mysqli -> prepare("SELECT priv FROM testUsers WHERE username=?

AND password=?")) {

/* Bind parameters

s - string, b - boolean, i - int, etc */

$stmt -> bind_param("ss", $user, $pass);

/* Execute it */

$stmt -> execute();

/* Bind results */

$stmt -> bind_results($result);

/* Fetch the value */

$stmt -> fetch();

echo $user . "'s level of priviledges is " . $result;

/* Close statement */

$stmt -> close();

}

/* Close connection */

$mysqli -> close();

解决方法:

至于防止mySQL注入的问题：是的. Mysqli的参数化查询可以安全地抵御注入攻击.

如果$user来自外部源,您可能希望添加htmlentities()echo语句以防止用户注册用户名,例如< script>(某些恶意代码)< / script>

标签：php,mysqli

来源： https://codeday.me/bug/20190929/1833235.html