Question

这是在一次逃离多个字符串时的好做法吗? 这些字符串来自POST还是Get?

现在有了PDO,但在这个代码里我不想用它。

class Bo extends Db
{
    function clean($cThis)
    {
        $res = array();
        foreach (array_keys($cThis) as $key) {
            $res[$key] = mysql_real_escape_string(addslashes($cThis[$key]));
        }
        return $res;
    }

    function add($info)
    {
        $this->dbConnect();
        $cInfo = $this->clean($info);

        mysql_query("INSERT INTO table (b, c) VALUES ( ".$cInfo[ b ]." ,  ".$cInfo[ c ]." )");
        $this->dbDisconnect();
    }
}

Answer 1

良好做法是使用PDO 和准备发言 ,not 手动解开字符串,将其整合到查询中,例如:

$db = DB::connect($dsn);
$sth = $db->prepare("INSERT INTO table (b, c) VALUES (?, ?)");
$res = $sth->execute(array($info[ b ], $info[ c ]));
$db->disconnect()

哦, 确保 < code> gpc_ magic_ quotes 也被禁用!

Answer 2

PDO 将是最好的选择, 但是如果您没有它, 则该 PDO 将会是最好的选择。在 Mysql 中, 有某些方法可以模仿 < code> pg_query_ params 。它被写成为类的方法, < code>$nthis- gt; dbconn 是 < code> mysqli_ init 返回的连接资源。当然, 您可以用合适的 < code> mysqli 类词修改 < code> mysqli 方法。

/**
 * Returns the single value of the array mysqli_query_params__parameters
 *
 * @param $at the position of the parameter inside the array mysqli_query_params__parameters
 * @return mixed
 */
public function mysqli_query_params__callback( $at )
{
    return $this->mysqli_query_params__parameters[ $at[1]-1 ];
}

/**
 * Parameterised query implementation for MySQL (similar PostgreSQL s PHP function pg_query_params)
 * Example: mysqli_query_params( "SELECT * FROM my_table WHERE col1=$1 AND col2=$2", array( 42, "It s ok" ), $dbconn );
 *
 * @param $query, $parameters, $datadase
 * @return mixed(resorce, false)
 * @access public
 */
public function mysqli_query_params( $query, $parameters=array(), $database=false )
{
    if( !is_array($parameters) ){
        return false;
    } else {
        if($this->is_assoc($parameters)){
            $parameters = array_values($parameters);
        }
    }

    // Escape parameters as required & build parameters for callback function
    foreach( $parameters as $k=>$v )
    {
        $parameters[$k] = ( is_int( $v ) ? $v : ( NULL===$v ?  NULL  : " ".mysqli_real_escape_string( $this->dbconn, $v )." " ) );
    }
    $this->mysqli_query_params__parameters = $parameters;

    // Call using mysqli_query
    if( false === $database )
    {
        $query = preg_replace_callback(  /$([0-9]+)/ , array($this,  mysqli_query_params__callback ), $query );
        $result = mysqli_query( $this->dbconn, $query );

        if( false === $result )
        {
            $err_msg = mysqli_error($this->dbconn);
            return false;
        } else {
            return $result;
        }
    }
    else
    {
        $query = preg_replace_callback(  /$([0-9]+)/ , array($this,  mysqli_query_params__callback ), $query );
        $result = mysqli_query( $this->dbconn, $query, $database );

        if( false === $result )
        {
            $err_msg = mysqli_error($this->dbconn);

            return false;
        } else {
            return $result;
        }
    }

    return false;
}

友情链接