php - 我仍然容易受到 SQL 注入(inject)攻击吗？ PHP

Question

我知道大多数人对此不以为然，但在我了解 PDO 语句和转义字符串之前，我不确定我应该如何防止 mysql 注入(inject)。

我创建了一个函数，它接受文本并通过过滤器运行它。我想知道它是否真的可以防止 sql 注入(inject)，或者他们是否可以绕过它？我当时的目标是让用户能够输入文本并能够准确地显示他们输入的内容。

除此之外，我还小心确保用户对数据库的权限不超过所需权限。我是否正在使用他们的输入来更新或插入新行等。但是考虑到我没有这样做它仍然有效吗？:

function filterInput($textToFilter)
{
    if ($textToFilter != null)
{



    //a = a
    //e = e
    //i = i
    //o = o
    //u  = u

    //A = A
    //E = E
    //I = I
    //O = O
    //U = U

    $textToFilter = str_ireplace('insert','ins&#101rt',$textToFilter);
    $textToFilter = str_ireplace('select','s&#101lect',$textToFilter);
    $textToFilter = str_ireplace('values','valu&#101s',$textToFilter);
    $textToFilter = str_ireplace('where','wher&#101',$textToFilter);
    $textToFilter = str_ireplace('order','ord&#101r',$textToFilter);
    $textToFilter = str_ireplace('into','int&#111',$textToFilter);
    $textToFilter = str_ireplace('drop','dr&#111p',$textToFilter);
    $textToFilter = str_ireplace('delete','delet&#101',$textToFilter);
    $textToFilter = str_ireplace('update','updat&#101',$textToFilter);
    $textToFilter = str_ireplace('set','s&#101t',$textToFilter);
    $textToFilter = str_ireplace('flush','fl&#117sh',$textToFilter);
    $textToFilter = str_ireplace("'","&#39",$textToFilter);
    $textToFilter = str_ireplace('"',"&#34",$textToFilter);
    $textToFilter = str_ireplace(';',"&#59",$textToFilter);
    $textToFilter = str_ireplace('>',"›",$textToFilter);
    $textToFilter = str_ireplace('<',"‹",$textToFilter);
$textToFilter = nl2br($textToFilter);
$filterInputOutput = $textToFilter;
return $filterInputOutput;  
}
}

Answer 1

由于您正在尝试推出自己的“过滤器”功能 - 标准响应是“是的，您是”。编写“安全”代码非常困难，您基本上是在重新发明轮子，而且这样做的方式很糟糕。

当你完全可以这样做的时候，你为什么要解决所有这些(毫无意义的)麻烦:

$safe_text = mysql_real_escape_string($badtext);

(或您的数据库库提供的任何转义函数)并让数据库为您完成所有繁重的工作？