dongyan8929 2014-01-24 13:15
浏览 72
已采纳

PHP在表名中从mysql_real_escape_string更改为PDO [duplicate]

This question already has an answer here:

I currently use mysql_real_escape_string to escape variable in mysql query. I know how to use bindValue, but I have a question about protection when I'm trying to insert table name from variable. For example

$tablename = mysql_real_escape_string($name_from_form);
$get = mysql_query("SELECT * FROM ".$tablename." WHERE keyword='something'");

Can anybody help me with an example of how to do PDO prepared statements which will do the same as above?

</div>
  • 写回答

1条回答 默认 最新

  • dsvs50005 2014-01-24 13:18
    关注

    You won't be able to escape the table name (I hope that $tablename isn't coming from an outside source - If it is, you will need to whitelist what table names are allowed). In PDO, your code could look something like:

    $allowedTables = array('posts', 'users');
    if(!in_array($tablename, $allowedTables)){
        throw new Exception('Invalid table name: ' . $tablename);
    }
    
    $keyword = 'something';
    $stmt = $dbh->prepare("SELECT * FROM " . $tablename . " WHERE keyword = :keyword");
    $stmt->bindParam(':keyword', $keyword);
    $stmt->execute();
    
    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 电脑开机过商标后就直接这样,求解各位
  • ¥15 mysql , 用自己创建的本地主机和用户名 登录不上
  • ¥15 关于#web项目#的问题,请各位专家解答!
  • ¥15 vmtools环境不正常
  • ¥15 请问如何在Ubuntu系统中安装使用microsoft R open?
  • ¥15 jupyter notebook
  • ¥30 informer时间序列预测
  • ¥20 SSR引物多态性分析
  • ¥15 大漠插件在Win11易语言注册调用和免注册灵异事件,VS上注册调用完全没问题
  • ¥15 Addressable缓存机制做热更新的问题