mysql query 参数,mysql_query的参数使用

somewhere while studying I juz found out something interesting.. It says something as follows:

$query = sprintf("SELECT firstname, lastname, address, age FROM friends

WHERE firstname='%s' AND lastname='%s'",mysql_real_escape_string($firstname),

mysql_real_escape_string($lastname));

using the query like this instead of

$query="select firstname, lastname, address, age FROM friends

WHERE firstname='".$_RETURN['name1']."', lastname='".$_RETURN['name2']."'";

does this seem reasonable.. have u tried this coding ever.. and how it helps prevent any malicious attacks..

解决方案

First off, what this is about is called is SQL-Injection. It's basically just the possibility to alter queries against the database via user input.

Let's look at an example:

Query:

SELECT temp1 FROM temp WHERE temp2 = 'VAR1';

Now we'll assign VAR1 the value of: '; DROP TABLE *; --

And we'll get:

SELECT temp1 FROM temp WHERE temp2 = ''; DROP TABLE *; --';

With mysql_real_escape_string it would look like this:

SELECT temp1 FROM temp WHERE temp2 = '\'; DROP TABLE *; --'

mysql_real_escape_string 'secures' a string for usage within a query.

But in the end, you should stop using the mysql_* altogether. They're deprecated and considered as insecure when it comes to preventing SQL injection or other means of tempering with the queries.

You should simply stop concatenating queries together like this and start using prepared statements, which not only are easier to use, prevent SQL Injection by default but also can improve the speed of your application.

For PHP there are two extensions which are designed to close the whole mysql_* opened:

And I say it again: Please stop using mysql_*!