sql注入攻击的预防函数-如何防御sql注入
1.预编译
2.捆绑变量各种过滤
用到的函数:
addslashes
htmlspecialchars
mysql_escape_string($string)
mysql_real_escape_string($string)
is_numeric(str) #判断是否为数字
![](https://images2015.cnblogs.com/blog/1049537/201704/1049537-20170412200545751-1782869717.png)
<?php function safe_replace($string){ $string = str_replace("*","",$string); $string = str_replace("insert","GG",$string); return $string; } $a = "aaaaabbbbbdddinsertddddqqdddeeee'eeeeeeee"; $b = safe_replace(addslashes($a)); echo $b; ?>
过滤多些几个。当然了 也可以用正则
By:珍惜少年时博客:http://www.cnblogs.com/xishaonian/
*-------------------------------------------*