SQL注入攻击

Question

可能重复： 防止PHP中SQL注入的最佳方法

我是PHP新手。我听说了很多SQL注入攻击(并且读到过)。我已经习惯了以下编写PHP代码的方式。有人能告诉我这是否容易受到SQL攻击吗。另外，我可以以何种方式改进这段代码以防止SQL攻击？

<?php
    if($_POST['submit']){
        $email = protect($_POST['email']);
        $password = protect($_POST['password']);
        $md5password=MD5($password);
        if(!$email || !$password){
            echo '<span style="color: red;" /><center>You need to fill in your <b>User Name</b> and <b>Password</b>!</center></span>';
        }else{
            $res = mysql_query("SELECT * FROM `employer` WHERE `email` = '".$email."'");
            $num = mysql_num_rows($res);
            if($num == 0){
                echo '<span style="color: red;" /><center>The <b>E Mail ID</b> you supplied does not exist!</center></span>';
            }else{
            $res = mysql_query("SELECT * FROM `employer` WHERE `email` = '".$email."' AND `password` = '".$md5password."'");
            $num = mysql_num_rows($res);
            if($num == 0){
                echo '<span style="color: red;" /><center>The <b>Password</b> you supplied does not match the one for that E Mail ID!</center></span>';}else{
                $row = mysql_fetch_assoc($res);
                $_SESSION['uid'] = $row['id'];
                echo "<center>You have successfully logged in!</center>";
                $time = date('U')+50;
                mysql_query("UPDATE `employer` SET `online` = '".$time."' WHERE `id` = '".$_SESSION['uid']."'");
                mysql_query("UPDATE employer (date) VALUES (NOW())");
                header('Location: loggedin_employer.php');
                }
            }
        }
    }
?>

Answer 1

您应该停止使用mysql_*函数。他们被人反对了。相反，可以使用PDO (PHP5.1支持)或米斯里 (PHP4.1支持)。如果你不确定该用哪一个，读这篇文章。

另外，请阅读此交换：如何防止PHP中的SQL注入？