原文：http://zhangxugg-163-com.iteye.com/blog/1835721
好文章不得不转。
我们都知道，只要合理正确使用PDO,可以基本上防止SQL注入的产生，本文主要回答以下两个问题：
为什么要使用PDO而不是mysql_connect？
为何PDO能防注入？
使用PDO防注入的时候应该特别注意什么?
一、为何要优先使用PDO?
PHP手册上说得很清楚：
Prepared statements and stored procedures
Many of the more mature databases support the concept of prepared statements. What are they? They can be thought of as a kind of compiled template for the SQL that an application wants to run, that can be customized using variable parameters. Prepared statements offer two major benefits:
The query only needs to be parsed (or prepared) once, but can be executed multiple times with the same or different parameters. When the query is prepared, the database will analyze, compile and optimize its plan for executing the query. For complex queries this process can take up enough time that it will noticeably slow down an application if there is a need to repeat the same query many times with different parameters. By using a prepared statement the application avoids repeating the analyze/compile/optimize cycle. This means that prepared statements use fewer resources and thus run faster.
The parameters to prepared statements don't need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur(however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).
即使用PDO的prepare方式，主要是提高相同SQL模板查询性能、阻止SQL注入
同时，PHP手册中给出了警告信息
PDO::MYSQL_ATTR_INIT_COMMANDdriver option, as the following example shows.Tags：[转]PDO防注入原理分析以及
相关文章列表:
热门排行
- 安装Composer时提示choose the command-line php
- 给EcStore商城会员添加推广返利功能
- swoole_http_response::write(): send 2875520 byte data fail, max_size is 2097152.
- yii2 init或者yii命令提示No such file or directory
- IDEA 2022.1.1最新激活教程
- Warning: session_write_close(): Failed to write session data using user defined
- PHP中的变量
- php 编程笔记分享
- 一定要搜藏的20个非常有用的PHP类库
- 一则 Mysql 建表语句