2016-11-25 21:56 阅读 46

插入表时不能使用符号(php / sql)

I have a problem with adding some text from my site if that text contain some symbols like (", ? , script, or some sql tags ) ..

Here is a little bit of code,hope this is enough :)

    $title = $_POST['title_field'];
    $description = $_POST['description_field'];
    $sql2 = 'INSERT INTO achievements (title,description) VALUES (' . '"' .$title . '"'. "," . '"' . $description . '"' . ')';
    $records2 = mysqli_query($conn,$sql2);

If you need any more line from my code just write,thanks a lot! :)

  • 点赞
  • 写回答
  • 关注问题
  • 收藏
  • 复制链接分享

1条回答 默认 最新

  • 已采纳
    dta38159 dta38159 2016-11-25 22:03

    The problem here is you're not using prepared statements and you're not escaping things properly, so some symbols conflict with SQL. In general terms this means you're vulnerable to SQL injection bugs.

    Switch to using parameterized queries and bind_param to fix this issue:

    $stmt = mysqli_prepare($conn, "INSERT INTO achievements (title, description) VALUES (?,?)");
    $stmt->bind_param("ss", $_POST['title_field'], $_POST['description_field']);

    As a note, try to avoid putting redundant things in names like _field. It's presumed to be a field if it's in a form submission.

    点赞 评论 复制链接分享