php 安全

最新推荐文章于 2026-01-08 18:49:09 发布

原创最新推荐文章于 2026-01-08 18:49:09 发布 · 414 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#php #mysql #encoding #string #application #query

本文介绍了如何通过使用mysql_real_escape_string函数来防止SQL注入攻击，并强调了正确设置字符集的重要性，尤其是在处理多字节编码如GBK时。推荐使用mysql_set_charset()函数而非SET NAMES指令来避免潜在的安全问题。

如何不使用prepared statment，而是用过滤的方法避免SQL注入呢？

一般来说mysql自带的过滤函数是比较可靠的。mysql_real_escape_string()

但是这个函数在某些字符集中有问题，比如GBK。如果你用UTF8那没关系。

在PHP里设置数据库的字符集不应该用：mysql_query("SET NAMES UTF8");

而应该用：mysql_set_charset()

这样mysql_real_escape_string()在处理GBK编码的时候就不会出问题了。

mysql_real_escape_string() not safe when SET NAMES is used

use mysql_set_charset() instead.

Note: This is the preferred way to change the charset. Using mysql_query() to execute SET NAMES .. is not recommended.

SET NAMES is usually used to switch the encoding from what is default to what the application needs. This is done in a way that mysql_real_escape_string doesn’t know about this. This means if you switch to some multi byte encoding that allows backslash as 2nd 3rd 4th… byte you run into trouble, because mysql_real_escape_string doesn’t escape correctly. UTF-8 is safe…

Safe way to change encoding is mysql_set_charset, but that is only available in new PHP versions