如何使此PHP脚本具有SQL注入验证功能？
<?php
$conn = mysql_connect("localhost", "root", "") or die ('Error connecting to MySQL!');
mysql_select_db("aspire");
$earnedpoints = false;
$account = $_POST['name'];
$account = mysql_real_escape_string($account);
if ($account == "") {
echo 'Enter an account name!';
exit();
}
$ip = $_SERVER['REMOTE_ADDR'];
$time = time();
$query = mysql_query("SELECT *, SUM(`times`) as amount FROM votingrecords WHERE account='$account' OR ip='$ip'");
$lasttime = mysql_fetch_array($query);
$amount = $lasttime['amount'];
$insertnew = false;
if ($amount == "") {
$insertnew = true;
}
$timecalc = $time - $lasttime['date'];
if (!$insertnew) {
if ($timecalc < 21600) {
echo ' Hello '. $account .' you have already voted with this account ('. $account .') or IP ('. $ip .') in the last 6 hours!';
echo ' Last voted on: '. date('M d\, h:i:s A', $lasttime['date']) .'';
echo '<html>';
echo '<head>';
echo '<meta HTTP-EQUIV="REFRESH" content="10; url=/">';
echo '</head>';
echo '<body>';
echo '<br><br>You will be redirected to the main website in 10 seconds.';
echo '</body>';
echo '</html>';
exit();
} else {
$update = mysql_query("UPDATE votingrecords SET account='$account', date='$time', times=times+1 WHERE ip='$ip'");
if (!$update) {
$message = 'Invalid query: ' . mysql_error() . "\n";
$message .= 'Whole query: ' . $update;
die($message);
} else {
$earnedpoints = true;
}
}
} else {
$success = mysql_query("INSERT INTO votingrecords (`account`, `ip`, `date`, `times`) VALUES ('$account', '$ip', '$time', 1)");
if (!$success) {
$message = 'Invalid query: ' . mysql_error() . "\n";
$message .= 'Whole query: ' . $success;
die($message);
} else {
$earnedpoints = true;
}
}
if ($earnedpoints) {
$points = mysql_query("UPDATE accounts SET votepoints = votepoints + 2 WHERE name='$account'");
if (!$points) {
$message = 'Invalid query: ' . mysql_error() . "\n";
$message .= 'Whole query: ' . $query;
die($message);
}
mysql_close($conn);
echo '<html>';
echo '<head>';
echo '<meta HTTP-EQUIV="REFRESH" content="0; url=http://www.gtop100.com/in.php?site=80994">';
echo '</head>';
echo '</html>';
} else {
echo 'There was an error processing your request.';
exit();
}
?>
大家好，
我对PHP脚本非常缺乏经验，而且有人告诉我我的脚本容易受到SQL注入的攻击？但我不确定如何才能防止SQL注入，因为我在该领域没有太多经验，而且我担心我会把代码搞乱。
有人能帮我这个忙吗？我将不胜感激。
回答 2
Stack Overflow用户
发布于 2017-06-19 11:38:42
How can I prevent SQL injection in PHP?
你的代码实际上是在转义输入值，但是mysql_connect在PHP5.5中被废弃了，在PHP7中完全被删除了。使用参数查询是你最好的选择：
您需要先打开连接，而不是
$conn = mysql_connect("localhost", "root", "") or die ('Error connecting to MySQL!'); mysql_select_db("aspire");
您将像这样打开连接
$mysqli = new mysqli("localhost", "root", "", "aspire");
然后准备您的查询，而不是像这样放入查询
$query = mysql_query("SELECT *, SUM(`times`) as amount FROM votingrecords WHERE account='$account' OR ip='$ip'");你可以这样说
$stmt = $mysqli->prepare("SELECT *, SUM(`times`) as amount FROM votingrecords WHERE account='?' OR ip='?'");这是一个已准备好的语句，不是您放入查询输入，而是PHP为您做这件事，您需要做的就是将查询输入与该$stmt绑定，如下所示
$stmt->bind_param("s", $account);
$stmt->bind_param("s", $ip);您有两个输入，分别是$account和$ip，帐户和ip都是字符串，这恰好是s代表的……现在将执行该语句，如下所示
$stmt->execute();别忘了关闭你打开的连接
$stmt->close();Stack Overflow用户
发布于 2017-06-19 11:17:43
请参阅此链接http://php.net/manual/en/pdo.prepared-statements.php
使用预准备语句和存储过程
https://stackoverflow.com/questions/44621723
复制相似问题
腾讯云开发者
Copyright © 2013 - 2026 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有
深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 
粤公网安备44030502008569号
腾讯云计算（北京）有限责任公司 京ICP证150476号 | 京ICP备11018762号