我正在处理一个现有网站,试图防止SQL注入攻击。在此之前,$_GET['ID']
是未经过滤的。
$ID=mysql_real_escape_string($_GET['ID']);
$sQuery=mysql_query("select * from tbl_mini_website as s1, tbl_actor_merchant as me where s1.MERCHANT_ID=$ID AND s1.MERCHANT_ID=me.MERCHANT_ID");
如果在URL末尾放置单引号,使用
mysql_real_escape_string()
函数后,从mysql_error()
获得以下结果:
如果不使用You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\\' AND s1.MERCHANT_ID=me.MERCHANT_ID' at line 1
mysql_real_escape_string()
函数,将会获得以下结果:
我不确定出了什么问题,如果能提供帮助将不胜感激。You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' AND s1.MERCHANT_ID=me.MERCHANT_ID' at line 1
echo
命令会发生什么? - zerkms