php - SELECT * FROM $_POST[] - PHP mySQL 格式化

Question

需要帮助格式化 mySQL 查询字符串。以下查询返回“解析错误，需要 T_STRING 或 T_VARIABLE”

PHP:

<?php


include 'db_connect.php';

mysql_select_db($databaseName, $con);

$query = "SELECT * FROM .$_POST['tab']. WHERE plant_code = .$_POST['plant_code']";

$result = mysql_query($query) or die (mysql_error());

$row = mysql_fetch_assoc($result);

echo json_encode($row);

?>

jQuery:

$('#profiles_desktops').click(function(){
                $.post("php/loadProfile.php", {plant_code : selectedSite, tab : "profiles_desktops"}, function(result){ (do something here...) });  });

Answer 1

不要那样做!它对 SQL 注入(inject)攻击是开放的。看在上帝的份上，验证并转义您的输入。

至少，将其重写为:

$query = "SELECT * FROM `".mysql_real_escape_string($_POST['tab'])."` WHERE plant_code = '".mysql_real_escape_string($_POST['plant_code'])."'";