Question

我如何阻止针头注射...... http://u.neighborrow.com/items/recent

Answer 1

如果你使用CakePHP S ORM方法(如发现和节省())和适当的阵列(如阵列(实地=和高价)而不是原材料,CakePHP已经保护了你免受注射。对特别安全局进行净化,通常更能节省数据库中未加修改和在产出/显示时实现节约的原始超文本。

This should give you a good idea of how to do it.

App::import( Sanitize ); 
class MyController extends AppController {     ...     ... }

一旦你这样做,你就可以呼吁静态地实现。

Answer 2

幼儿园负责照料。 Read their book 。

Answer 3

只有在你需要撰写原始询问的罕见情况下,你才需要san。

进口

$this->User->query("select username from users where email= $email_received_from_user_form ");

before executing that you need to:

App::import( Sanitize );

$email_received_from_user_form = Sanitize::paranoid($email_received_from_user_form, array( @ ,  _ ,  - ,  . ));

如果使用正确的数据,净化将消除/处理电离层中的所有恶果(无液喷射)。

见http://book.cakephp.org/2.0/en/core-utility-libraries/sanitize.html。

在你学习所有数据集之后,试图永远不使用数据。采用卡纳克民阵这样的方式:

$this->User->field( username , array( email  => $email_received_from_user_form));

我这样说,你根本就不必担心Kingk注射。除非你没有其他选择,否则你永远不应使用原始问题。