php - mysql_real_escape_string() 是否完全防止 SQL 注入(inject)？

Question

开启 http://www.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/?akst_action=share-this ，有一个部分声称您可以使用某些亚洲字符编码绕过 mysql_real_escape_string

Bypassing mysql_real_escape_string() with BIG5 or GBK

"injection string"
に関する追加情報：

the above chars are Chinese Big5

这是真的吗？如果是这样，如果您无法访问准备好的声明，您将如何保护您的网站免受此类攻击？

Answer 1

根据 Stefan Esser，“mysql_real_escape_string() [is] 在使用 SET NAMES 时不安全。”

他的解释，from his blog :

SET NAMES is usually used to switch the encoding from what is default to what the application needs. This is done in a way that mysql_real_escape_string doesn’t know about this. This means if you switch to some multi byte encoding that allows backslash as 2nd 3rd 4th… byte you run into trouble, because mysql_real_escape_string doesn’t escape correctly. UTF-8 is safe…

Safe way to change encoding is mysql_set_charset, but that is only available in new PHP versions

不过，他确实提到 UTF-8 是安全的。