mysql_real_escape_string

wangxinarhat 发布于2019-07-31 15:54 / 2131人阅读

CI中：

$this->db->select("*")->where("username","skcdian")->where("password","" OR ""="")->get("user")->result();

SELECT * FROM (user) WHERE username = "skcdian" AND password = "" OR ""=""

$password=""" OR ""="" ";
mysql_real_escape_string($password);

"" OR ""=""

$password=""" OR ""="" ";
$data1=$this->db->query("SELECT * FROM (user) WHERE username = "skcdian" AND password = {$password};")->result();

CIsystemdatabasedriversmysqlmysql_driver.php

function escape_str($str, $like = FALSE)
{
	if (is_array($str))
	{
		foreach ($str as $key => $val)
   		{
			$str[$key] = $this->escape_str($val, $like);
   		}

   		return $str;
   	}

	if (function_exists("mysql_real_escape_string") AND is_resource($this->conn_id))
	{
		$str = mysql_real_escape_string($str, $this->conn_id);
	}
	elseif (function_exists("mysql_escape_string"))
	{
		$str = mysql_escape_string($str);
	}
	else
	{
		$str = addslashes($str);
	}

	// escape LIKE condition wildcards
	if ($like === TRUE)
	{
		$str = str_replace(array("%", "_"), array("\%", "\_"), $str);
	}

	return $str;
}

服务器托管云服务器

文章版权归作者所有，未经允许请勿转载,若此文章存在违规行为，您可以联系管理员删除。

转载请注明本文地址：https://www.ucloud.cn/yun/46503.html

mysql_real_escape_string

CI中： $this->db->select(*)->where(username,skcdian)->where(password, OR =)->get(user)->result(); SELECT * FROM (user) WHERE username = skcdian AND password = OR = $password= OR = ; mysql_real_escape...

RichardXG 2019-08-27 14:22 评论0 收藏0
mysql_real_escape_string

CI中： $this->db->select(*)->where(username,skcdian)->where(password, OR =)->get(user)->result(); SELECT * FROM (user) WHERE username = skcdian AND password = OR = $password= OR = ; mysql_real_escape...

RyanQ 2019-08-01 13:23 评论0 收藏0
php 中使用mysql_real_escape_string时数据被清空的解决办法

http://segmentfault.com/q/1010000000151704 其实并不是这个方法的问题而是你的数据库链接报错了！

UCloud 2019-07-31 15:48 评论0 收藏0
php 中使用mysql_real_escape_string时数据被清空的解决办法

http://segmentfault.com/q/1010000000151704 其实并不是这个方法的问题而是你的数据库链接报错了！

tainzhi 2019-07-01 14:14 评论0 收藏0
php 中使用mysql_real_escape_string时数据被清空的解决办法

http://segmentfault.com/q/1010000000151704 其实并不是这个方法的问题而是你的数据库链接报错了！

Doyle 2019-08-27 14:22 评论0 收藏0