php 通用防post代码,php:如何防止$POST中的SQL注入

我有一些php脚本,我认为这有很多错误。因为我在连接和SQL注入方面的知识有限。第一次我没有任何麻烦,因为这个脚本使用PHP Mysql。

但当我尝试转换成Interbase后,我遇到了很多麻烦。

请帮忙找出我的错。

以下是我的问题:

$sLimit = "";

if ( isset( $_POST['iDisplayStart'] ) )

{

$sLimit = " FIRST ".$_POST['iDisplayStart']." SKIP ".$_POST['iDisplayLength'];

}

$sOrder ="";

$sOrder = " ORDER BY LINE_NAME ";

$sWhere = "";

if (postVar('sSearch') !="" )

{

$sWhere = " WHERE (LINE_NAME LIKE '%".$_POST['sSearch']."%' OR

MODEL_ONLY LIKE '%".$_POST['sSearch']."%' OR ".

" VER_ONLY LIKE '%".$_POST['sSearch']."%' OR ".

" LOT_SIZE LIKE '%".$_POST['sSearch']."%' OR ".

" START_SERIAL LIKE '%".$_POST['sSearch']."%' OR ".

" SERIAL_NO_LOW LIKE '%".$_POST['sSearch']."%' OR ".

" SERIAL_NO_UP LIKE '%".$_POST['sSearch']."%' OR ".

" PROD_NO LIKE '%".$_POST['sSearch']."%' OR ".

" PROD_DATE LIKE '%".$_POST['sSearch']."%') ";

}

$sQuery = "SELECT LINE_NAME, MODEL_ONLY, VER_ONLY, PROD_NO,

LOT_SIZE, START_SERIAL, SERIAL_NO_LOW, SERIAL_NO_UP, PROD_DATE

FROM DOC_TO".$sWhere.$sOrder.$sLimit.";";

$rResult = ibase_query( $sQuery) or _doError(_ERROR30 . ' (' . htmlspecialchars($sql) . '): ' . ibase_errmsg() );

$sQuery = "SELECT COUNT(*) FROM (SELECT LINE_NAME, MODEL_ONLY, VER_ONLY, PROD_NO,

LOT_SIZE, START_SERIAL, SERIAL_NO_LOW, SERIAL_NO_UP, PROD_DATE

FROM DOC_TO'.$sWhere.$sOrder.$sLimit.')";

$rResultFilterTotal = ibase_query( $sQuery) or _doError(_ERROR30 . ' (' . htmlspecialchars($sql) . '): ' . ibase_errmsg() );

$aResultFilterTotal = ibase_fetch_assoc($rResultFilterTotal);

$iFilteredTotal = $aResultFilterTotal[0];

注意:我需要了解更多关于连接的信息。谢谢提前。

错误:

Dynamic SQL Error SQL error code = -104 Token unknown - line 3, column 39 '.. ORDER BY LINE_NAME ..'