转换成安全的 PDO 语句？

Question

有人可以告诉我如何使用 PDO 将我当前的 UPDATE tablename SET column 转换为安全可靠的语句以防止 SQL 注入吗？我试图更好地理解绑定和 PDO，但在使用 PDO 进行设置时遇到了麻烦。这是我目前拥有的常规 msqli

<?php

session_start();
$db = mysqli_connect("hostname", "username", "password", "dbname"); 
$username = $_SESSION['jigowatt']['username'];
mysqli_query($db, "UPDATE login_users SET Points=Points+15 WHERE username='$username'");


?>

Answer 1

MySQL

您不需要 PDO 或 MySQLi。 mysql_real_escape_string保护你免受sql注入：

$name = 'Bob';
$age = 25;
$description = "' OR 1=1"; // a SQL injection string

$query = "
UPDATE people(name, age, description) 
VALUES ('".mysql_real_escape_string($name)."', ".(int) $age.", '".mysql_real_escape_string($description)."');";

// a secure query execution
$result = mysql_query($query);

PDO

与PDO::quote()

PDO::quote() 等于mysql_real_escape_string：

$pdo = new PDO(...);

$name = 'Bob';
$age = 25;
$description = "' OR 1=1"; // a SQL injection string

$query = "
UPDATE people(name, age, description) 
VALUES (".$pdo->quote($name).", ".(int) $age.", ".$pdo->quote($description).");";

// a secure query execution
$result = $pdo->query($query);

使用准备好的语句

您可以使用准备好的语句。您可以将空洞查询放在准备好的语句中，但最好对变量使用占位符：

$pdo = new PDO(...);

$name = 'Bob';
$age = 25;
$description = "' OR 1=1"; // a SQL injection string

$query = "
UPDATE people(name, age, description) 
VALUES (:name, :age, :description);";

$stmt = $pdo->prepare($query); // prepare the query

// execute the secure query with the parameters
$result = $pdo->execute(array(
    ':name' => $name,
    ':age' => $age,
    ':description' => $description,
));