如何避免使用PDO进行mysql注入

问题描述

如何避免mysql注入?这是我现在拥有的PHP文件

How can I avoid mysql injections? This is the PHP file I have right now

<?php
include 'config.php';

$Name = $_GET['Name'] ;

$sql = "Select * from tables where names =\"$Name\"";



try {
    $dbh = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
    $dbh->query('SET CHARACTER SET utf8');
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $stmt = $dbh->query($sql);  
    $names = $stmt->fetchAll(PDO::FETCH_OBJ);
    $dbh = null;
    echo '{"key":'. json_encode($names) .'}'; 
} catch(PDOException $e) {
    echo '{"error":{"text":'. $e->getMessage() .'}}'; 
}


?>

当我在代码中放入$stmt = $dbh->query($sql); $stmt->execute(array(':name' => $name));时，它不起作用.那我该怎么办呢?

When I put $stmt = $dbh->query($sql); $stmt->execute(array(':name' => $name)); to the code it doesn't work. So how should I do it?

推荐答案

了解 pdo准备好的语句

这是一个例子

$stmt = $dbh->prepare("SELECT * FROM tables WHERE names = :name");
$stmt->execute(array(':name' => $name));

这篇关于如何避免使用PDO进行mysql注入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！