mysql_real_escape_string -登录脚本

Question

我目前正在升级一个朋友网站的代码，并遇到了一个登录脚本的问题。我正在尝试使用mysql_real_escape_string()来阻止SQL注入。mysql_escape_string()运行得很好，但mysql_real_escape_string()不能。这是我得到的：

if (isset($_POST['submit']))
{
    $username = mysql_real_escape_string($_POST['username']); 
    $password = mysql_real_escape_string($_POST['password']);

    $db_link = db_connect("project");
    $query = "SELECT * FROM user WHERE username = '$username' AND password = password('$password')";
    $result = mysql_query($query) or die (mysql_error());
    $numrows = mysql_num_rows($result);

    if($numrows == 1)
    {
        RedirectToURL("home.php");
    }
    else
    {
        login_page("Invalid login! Try again");
    }   
}
else
{
    login_page("");
}

Answer 1

要使用mysql_real_escape_string，您必须登录到数据库。如果您未登录，请使用mysql_escape_string。

Answer 2

正如@MichaelBerkowski在你的评论中所说的那样，将mysql_real_escape_string()调用移到连接命令之后：

if (isset($_POST['submit']))
{

    $db_link = db_connect("project");

    $username = mysql_real_escape_string($_POST['username']); 
    $password = mysql_real_escape_string($_POST['password']);

    $query = "SELECT * FROM user WHERE username = '$username' AND password = password('$password')";
    $result = mysql_query($query) or die (mysql_error());
    $numrows = mysql_num_rows($result);

    if($numrows == 1)
    {
        RedirectToURL("home.php");
    }
    else
    {
        login_page("Invalid login! Try again");
    }   
}
else
{
    login_page("");
}

如上所述，原因是that mysql_real_escape_string()依赖于您的mysql连接才能工作