php - 使用 PDO quote() 时是否可能进行 SQL 注入(inject)？

Question

我有以下代码(它的简单版本):

$query = "SELECT *
FROM text
WHERE MATCH (text) AGAINST ('".$pdo->quote($_GET["q"])."' IN BOOLEAN MODE);";

有什么方法可以克服 quote() 函数并将 SQL 注入(inject)到查询中——或者 quote() 是 100% 安全的吗？

非常感谢!

Answer 1

PDO::quote() places quotes around the input string (if required) and escapes special characters within the input string, using a quoting style appropriate to the underlying driver.

所以看起来它可以防止 SQL 注入(inject)。虽然，准备好的语句保证了 SQL 注入(inject)保护，正如我们可以从 PHP 手册中读到的那样:

If you are using this function to build SQL statements, you are strongly recommended to use PDO::prepare() to prepare SQL statements with bound parameters instead of using PDO::quote() to interpolate user input into an SQL statement. Prepared statements with bound parameters are not only more portable, more convenient, immune to SQL injection, but are often much faster to execute than interpolated queries, as both the server and client side can cache a compiled form of the query.

您可以在 http://php.net/manual/en/pdo.quote.php 阅读更多相关信息