如何在下面的代码中避免 SQL 注入？ [复制]

Question

我一直在思考如何避免对我的代码进行 SQL 注入攻击。

这就是我现在所拥有的。

<?php
session_start();
$email = $_POST['e-mail'];
$fn = $_POST['firstname'];
$ln = $_POST['lastname'];
$cp = $_POST['cellphone'];
$phn = $_POST['phone_number'];
$comp = $_POST['company'];
$prov = $_POST['province'];
$brgy = $_POST['barangay'];
$fadd = $_POST['address'];
$sadd = $_POST['address2'];

$conn = mysqli_connect('localhost','root','','newcartdb')or die('Could not connect');

foreach($_POST['product'] as $product)
{
    $date = date('Y-m-d H:i:s');
    $order_name = $product['item_name'];
    $order_code = $product['item_code'];
    $order_qty = $product['item_qty'];
    $sub_total = $product['price'];

    $query = "INSERT INTO `newcartdb`.`orders`(`Email`,`Firstname`,`Lastname`,`ContactNum`,`PhoneNum`,`Company`,`Province`,`Barangay`,`FAddress`,`SAddress`,`ProductName`,`ProductCode`,`Qty`,`SubTotal`,`datetime`) VALUES('$email','$fn','$ln','$cp','$phn','$comp','$prov','$brgy','$fadd','$sadd','$order_name','$order_code','$order_qty','$sub_total','$date')";
    mysqli_query($conn,$query);
}



mysqli_close($conn);

header('Location: order_confirmation.php');
?>

我该如何改进？

Answer 1

正如建议的那样，prepared statements 是实现良好防止 SQL 注入的最佳方法。

简化示例

您需要添加条目以填写您希望插入的所有列。

$email = $_POST['e-mail'];
$fn = $_POST['firstname'];
$ln = $_POST['lastname'];

if ($stmt = $mysqli->prepare("INSERT INTO `newcartdb`.`orders`(Email,Firstname,Lastname) values(?,?,?)") {
    $stmt->bind_param("sss",  $email, $fn, $ln);

“sss” - 表示数据类型，即“s” - 字符串，“i” - 每个条目的整数。

values(?,?,?) - 这是 bind_params 语句的占位符，所以 '?'将按顺序替换为您在 bind_params 方法中放置的值

    $stmt->execute();

    $_SESSION['notice'] = "Table updated";
}

else{
    $_SESSION['notice'] = "Table could not be updated!";
}