如何将我的SQL语句更改为准备（和安全）语句？ [重复]

Question

这个问题在这里已有答案：

• How can I prevent SQL injection in PHP? 28回答

基本上我想保护自己免受SQL注入。我曾尝试在网上搜索和观看视频，但无法准确理解我必须改变的内容，因为据我所知，每个人都会有所不同。任何帮助表示赞赏！

?php
// Create connection
$con = mysqli_connect("IPAddress","User","Password","DBName");
// Check connection
if ($con->connect_error) {
    die("Connection failed: " . $con->connect_error);
}

$sql = "INSERT INTO Email_Subs (email)
VALUES ('$_POST[email]')";

if ($con->query($sql) === TRUE) {
    echo "You have successfully subscribed!";
} else {
    echo "Error: " . $sql . "<br>" . $con->error;
}

$con->close();
?>

Answer 1

您必须首先使用新的mysqli（）而不是mysqli_connect（）来避免下一个php版本中的任何错误

    <?php 

    /* CONNECTION */
    $database_connection = new StdClass();

    /** MySQL hostname */
    $database_connection->server = 'localhost';

    /** MySQL database username */
    $database_connection->username = 'root';

    /** MySQL database password */
    $database_connection->password = '';

     /** The name of the database */
     $database_connection->name = 'yourdatabasename';

     /* ESTABLISHING THE CONNECTION */
    $database = new mysqli($database_connection->server, $database_connection->username, $database_connection->password, $database_connection->name); 

            if($database->connect_error) {

                echo 'connection failed';
            }

   ?>

然后做这样的事情：

$stmt = $database->prepare("INSERT INTO Email_Subs (email) VALUES (?)"); 
$stmt->bind_param("s", $_POST[email]);
$stmt->execute();
$stmt->close();
$database->close();