duanleiliu7373 2016-08-10 14:08
浏览 79

使用此功能可以安全地防止“SQL注入”吗?

Many days ago, my friend read this question: How can I prevent SQL injection in PHP?. And, I know that there are many good answers to solve this problem.

I have a friend, who is working with PHP better than me. Yesterday, he said to me: "There are many good answers, in here. But, can you write other code for solving this problem?".

He still uses PHP 4; so, he do not like to use any mysqli_ function, not me.


So, I have created a simple function, in PHP:

<?php

function MyFun($MyVar)

{
    if(!get_magic_quotes_gpc()) { $MyVar = addslashes($MyVar); }

    $MyVar = strip_tags($MyVar);
    $MyVar = htmlentities($MyVar);

    return trim($MyVar);

}

?>

I used my function in every $_POST[]; or $_GET[];, for instance:

$Var1 = MyFun($_POST['Txt1']);
$Var2 = MyFun($_GET['Txt2']);

My friend said that: "It can not prevent any SQL injection.". I do not think so.


Can you tell me: "Is it safe to prevent SQL injection, with this function?".

  • 写回答

0条回答 默认 最新

    报告相同问题?

    悬赏问题

    • ¥15 关于#MATLAB#的问题,如何解决?(相关搜索:信噪比,系统容量)
    • ¥500 52810做蓝牙接受端
    • ¥15 基于PLC的三轴机械手程序
    • ¥15 多址通信方式的抗噪声性能和系统容量对比
    • ¥15 winform的chart曲线生成时有凸起
    • ¥15 msix packaging tool打包问题
    • ¥15 finalshell节点的搭建代码和那个端口代码教程
    • ¥15 Centos / PETSc / PETGEM
    • ¥15 centos7.9 IPv6端口telnet和端口监控问题
    • ¥20 完全没有学习过GAN,看了CSDN的一篇文章,里面有代码但是完全不知道如何操作