blocks|key|2503223|text|看起来他们正在过滤掉SQL注入，所以你不用担心。他们已将其列为其关键特性之一|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2503224|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Seems like they are filtering out SQL Injections are you don't have to worry about it. [They have listed it as one of their key features]

blocks|key|5874729|text|快速浏览一下代码，这个类基本上是一个用于多种数据库类型的CRUD。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5874730|它们使用quote()方法来转义用户输入。|5874731|虽然PHP建议|5874732|5874733|如果您使用quote()来构建SQL语句，强烈建议您使用PDO::+prepare+()来准备带有绑定参数的SQL语句，而不要使用PDO::quote()来将用户输入插入到SQL语句中。带有绑定参数的预准备语句不仅更可移植、更方便、不受SQL注入的影响，而且执行速度通常比插值查询快得多，因为服务器和客户端都可以缓存已编译形式的查询。|blockquote|5874734|5874735|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Create,_read,_update_and_delete|1|http://php.net/manual/en/pdo.quote.php^0|S|4|0|0|4|7|1|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|F|3|G|5|6|7|14|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|15|8|@]|9|@]|C|$]]|$1|I|3|J|5|K|7|16|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|17|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|18|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]]]

A quick look at the code the class is basically a <a href="http://en.wikipedia.org/wiki/Create,_read,_update_and_delete" rel="nofollow">CRUD</a> for multiple database types. 

They use the <a href="http://php.net/manual/en/pdo.quote.php" rel="nofollow">quote()</a> method to escape user input.

Though PHP suggest

<blockquote>
 If you are using quote() to build SQL
 statements, you are strongly recommended to use PDO::prepare() to
 prepare SQL statements with bound parameters instead of using
 PDO::quote() to interpolate user input into an SQL statement. Prepared
 statements with bound parameters are not only more portable, more
 convenient, immune to SQL injection, but are often much faster to
 execute than interpolated queries, as both the server and client side
 can cache a compiled form of the query.
</blockquote>

blocks|key|3762795|text|实际上，从代码来看，他们似乎没有使用PDO+prepare方法来构造代码，这意味着即使使用引号，也可能使用奇怪的宽字符进行黑客攻击。请参阅https://security.stackexchange.com/questions/9908/multibyte-character-exploits-php-mysql|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3762796|entityMap|0|LINK|mutability|MUTABLE|url|https://security.stackexchange.com/questions/9908/multibyte-character-exploits-php-mysql^0|1X|2G|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Actually, looking at the code, they don't seem to use the PDO prepare approach to constructing their code, which means even with quote, a hack may be possible using weird wide characters. See <a href="https://security.stackexchange.com/questions/9908/multibyte-character-exploits-php-mysql">https://security.stackexchange.com/questions/9908/multibyte-character-exploits-php-mysql</a>

blocks|key|592102|text|Medoo放弃了对PDO+prepare的支持，因为prepare的引用过程不能很好地处理当前序列化的数组数据，并且存在一些兼容问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|592103|但是，如果您喜欢http://medoo.in/api/pdo，则可以使用它|offset|length|592104|$calories+=+150;
$colour+=+'red';

$sth+=+$database->pdo->prepare('SELECT+name,+colour,+calories
++++FROM+fruit
++++WHERE+calories+<+:calories+AND+colour+=+:colour');

$sth->bindParam(':calories',+$calories,+PDO::PARAM_INT);
$sth->bindParam(':colour',+$colour,+PDO::PARAM_STR,+12);

$sth->execute();|code-block|syntax|javascript|592105|entityMap|0|LINK|mutability|MUTABLE|url|http://medoo.in/api/pdo^0|0|8|N|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@$D|U|E|V|1|W]]|A|$]]|$1|F|3|G|5|H|7|X|8|@]|9|@]|A|$I|J]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Medoo dropped support of PDO prepare because the quoting process of prepare is not good with serialized array data in current, and with some compatible issues. 

However you can use it if you like <a href="http://medoo.in/api/pdo" rel="nofollow">http://medoo.in/api/pdo</a>

<pre><code>$calories = 150;
$colour = 'red';

$sth = $database-&gt;pdo-&gt;prepare('SELECT name, colour, calories
 FROM fruit
 WHERE calories &lt; :calories AND colour = :colour');

$sth-&gt;bindParam(':calories', $calories, PDO::PARAM_INT);
$sth-&gt;bindParam(':colour', $colour, PDO::PARAM_STR, 12);

$sth-&gt;execute();
</code></pre>

blocks|key|5874787|text|默认情况下，1.6.1版似乎无法转义。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5874788|$database+=+new+Medoo([
++++"database_type"+=>+"mysql",
++++"database_name"+=>+"database",
++++"server"+=>+"localhost",
++++"username"+=>+"user",
++++"password"+=>+"1234",
++++"charset"+=>+"utf8"
]);


//+Original+proper+query+and+injection

$table_proper_plain+=+'TAB_1';
$table_inject_plain+=+'TAB_1"+UNION+SELECT+username,+password+FROM+TAB_2;#';

$database->select($table_proper_plain,+["COL_1","COL_2"]);
//+SELECT+`COL_1`,`COL_2`+FROM+`TAB_1`
//+valid,+returns+rows+from+TAB_1
//+works+as+expected

$database->select($table_inject_plain,+["COL_1","COL_2"]);
//+SELECT+`COL_1`,`COL_2`+FROM+`TAB_1`+UNION+SELECT+username,+password+FROM+TAB_2;#"
//+valid(!),+returns+rows+from+TAB_1+AND+TAB_2(!)
//+bad,+injection+successful


//+Using+method+quote+on+proper+and+injection+query

$table_proper_quote+=+$database->quote($table_proper_plain);
$table_inject_quote+=+$database->quote($table_inject_plain);

$database->select($table_proper_quote,+["COL_1","COL_2"]);
//+SELECT+`COL_1`,`COL_2`+FROM+"'TAB_1'"
//+not+valid,+error+1146:+Table+'database.'TAB_1''+doesn't+exist
//+bad,+quoting+broke+query

$database->select($table_inject_quote,+["COL_1","COL_2"]);
//+SELECT+`COL_1`,`COL_2`+FROM+"'TAB_1\"+UNION+SELECT+username,+password+FROM+TAB_2;#'"
//+not+valid,+error+1146:+Table+'database.'TAB_1''+doesn't+exist
//+good,+injection+not+successful|code-block|syntax|javascript|5874789|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Version 1.6.1 doesn't seem to escape by default.

<pre><code>$database = new Medoo([
 "database_type" =&gt; "mysql",
 "database_name" =&gt; "database",
 "server" =&gt; "localhost",
 "username" =&gt; "user",
 "password" =&gt; "1234",
 "charset" =&gt; "utf8"
]);


// Original proper query and injection

$table_proper_plain = 'TAB_1';
$table_inject_plain = 'TAB_1" UNION SELECT username, password FROM TAB_2;#';

$database-&gt;select($table_proper_plain, ["COL_1","COL_2"]);
// SELECT `COL_1`,`COL_2` FROM `TAB_1`
// valid, returns rows from TAB_1
// works as expected

$database-&gt;select($table_inject_plain, ["COL_1","COL_2"]);
// SELECT `COL_1`,`COL_2` FROM `TAB_1` UNION SELECT username, password FROM TAB_2;#"
// valid(!), returns rows from TAB_1 AND TAB_2(!)
// bad, injection successful


// Using method quote on proper and injection query

$table_proper_quote = $database-&gt;quote($table_proper_plain);
$table_inject_quote = $database-&gt;quote($table_inject_plain);

$database-&gt;select($table_proper_quote, ["COL_1","COL_2"]);
// SELECT `COL_1`,`COL_2` FROM "'TAB_1'"
// not valid, error 1146: Table 'database.'TAB_1'' doesn't exist
// bad, quoting broke query

$database-&gt;select($table_inject_quote, ["COL_1","COL_2"]);
// SELECT `COL_1`,`COL_2` FROM "'TAB_1\" UNION SELECT username, password FROM TAB_2;#'"
// not valid, error 1146: Table 'database.'TAB_1'' doesn't exist
// good, injection not successful
</code></pre>

Medoo is a PHP database framework. Does anyone know whether I need to sanitise user input before using the insert() function? On the homepage (<a href="http://medoo.in/" rel="nofollow">http://medoo.in/</a>) under the "Why medoo?" section then it simply says "prevent SQL injection" but I don't know if that means it does it for you or that it's just easier to do so.

Does anyone know? I seems more likely that it does it for you but I'd rather know for sure.

Sanitising user input with Medoo

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

Medoo是一个PHP数据库框架。有人知道我在使用insert()函数之前是否需要清理用户输入吗？在主页()上的“为什么是medoo?”部分，然后它只是简单地说“防止SQL注入”，但我不知道这是否意味着它为您做了它，或者它只是更容易做到这一点。有人知道吗？我看起来更有可能是为你做的，但我更愿意确定。

问使用Medoo清理用户输入
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Medoo清理用户输入EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Medoo清理用户输入
EN