防止SQL注入-PDO，mysqli

问题描述

我刚刚发现我的网站很糟糕.

I just found that my website is vunerable.

由于它已连接到数据库，并具有以下功能:注册，更改密码，通知等...，并且假定它完全脆弱.

Since it's connected to a DB and have functions like: Register, Change Password, Notices, etc... and SUPOSING it's fully vulnerable.

我应该在代码中寻找什么以使其变得安全?

What should I look for into the code in order to start making it safe?

我的意思是，我做了一些研究，到处都有，每个人对安全性的看法都不尽相同.

I mean, I did some researches and everywhere, everyone says different things about security.

使用mysql_real_escape_string."

"Use mysql_real_escape_string."

使用加号."

我应该寻找什么?

"$_POST" and "$_GET" variables??
"$_SESSION" variables?

SQL查询?

$sql = "select * from user";
$sql = "update user set user="new_user_name";
$sql = "insert into user (user) values ('userid')";

在每种情况下我该怎么办?拜托，帮我知道我该去什么地方和去哪里.

What should I do in each case?Please, help me to know what and where I must go.

谢谢.

推荐答案

以下是制作安全php应用程序要考虑的重点.

Following are the points to be considered for making safe php application.

1. 使用PDO或mysqli
2. 从不信任任何输入.考虑每个变量，即$ _POST，$ _ GET，$ _ COOKIE，$ _ SESSION，$ _ SERVER，就好像它们已被污染一样.对这些变量使用适当的过滤措施.
3. 为避免XSS攻击，请使用php的内置函数htmlentities，将用户输入数据插入数据库.
4. 禁用PHP.INI中的全局寄存器
5. 在PHP.INI中禁用"allow_url_fopen"
6. 不允许用户输入超出要求的数据.验证输入到允许最大字符数.还要验证每个字段的相关数据类型.
7. 在开发期之后禁用错误报告.它可能会给有关数据库的信息，这些信息将对黑客有用.
8. 发布表单时使用一次令牌.如果令牌存在并且匹配表单发布有效，否则无效.
9. 使用参数化的数据库查询
10. 使用存储过程

1. USE PDO or mysqli
2. Never trust any inputs. Consider every variable viz $_POST, $_GET, $_COOKIE, $_SESSION, $_SERVER as if they were tainted. Use appropriate filtering measure for these variables.
3. To avoid XSS attack use php’s builtin functions htmlentities,strip_tags, etc while inserting the user input data into thedatabase.
4. Disable Register Globals in PHP.INI
5. Disable "allow_url_fopen" in PHP.INI
6. Don’t allow user to input more data than required. Validate input toallow max number of characters. Also validate each field forrelevant datatypes.
7. Disable error reporting after Development period. It might giveinformation about database that’ll be useful to hackers.
8. Use one time token while posting a form. If token exist and matchesthe form post is valid otherwise invalid.
9. Use parametrized database queries
10. Use stored procedures

您可以通过Google搜索每个点以获取更多详细信息.希望这会有所帮助

You can google for each point for more details.HOpe this helps

这篇关于防止SQL注入-PDO，mysqli的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！