forked from netkiller/netkiller.github.io
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathch14s03.html
More file actions
executable file
·112 lines (96 loc) · 8.29 KB
/
Copy pathch14s03.html
File metadata and controls
executable file
·112 lines (96 loc) · 8.29 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>14.3. 数据库开发规范</title><link rel="stylesheet" type="text/css" href="/docbook.css" /><meta name="generator" content="DocBook XSL Stylesheets V1.78.1" /><meta name="keywords" content="php, pear, pecl, phar" /><link rel="home" href="index.html" title="Netkiller PHP 手札" /><link rel="up" href="norm.html" title="第 14 章 开发规范" /><link rel="prev" href="ch14s02.html" title="14.2. String" /></head><body><a xmlns="" href="http://netkiller.github.io/">Home</a> |
<a xmlns="" href="http://netkiller.github.io/">简体中文</a> |
<a xmlns="" href="http://netkiller.sourceforge.net/">繁体中文</a> |
<a xmlns="" href="/journal/index.html">杂文</a> |
<a xmlns="" href="/search.html">Search</a> |
<a xmlns="" href="http://netkiller-github-com.iteye.com/">ITEYE 博客</a> |
<a xmlns="" href="http://my.oschina.net/neochen/">OSChina 博客</a> |
<a xmlns="" href="https://www.facebook.com/bg7nyt">Facebook</a> |
<a xmlns="" href="http://cn.linkedin.com/in/netkiller/">Linkedin</a> |
<a xmlns="" href="mailto:netkiller@msn.com">Email</a><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">14.3. 数据库开发规范</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14s02.html">上一页</a> </td><th width="60%" align="center">第 14 章 开发规范</th><td width="20%" align="right"> </td></tr></table><hr /><table width="100%" border="0"><tr><td align="left"><a href="http://netkiller.sourceforge.net/">Home</a> |
<a href="http://netkiller.github.com/">Mirror</a> |
<a href="/search.html">Search</a></td><td align="right"></td></tr></table></div><table xmlns=""><tr><td><iframe src="http://ghbtns.com/github-btn.html?user=netkiller&repo=netkiller.github.com&type=watch&count=true&size=large" height="30" width="170" frameborder="0" scrolling="0" style="width:170px; height: 30px;" allowTransparency="true"></iframe></td><td><iframe src="http://ghbtns.com/github-btn.html?user=netkiller&repo=netkiller.github.com&type=fork&count=true&size=large" height="30" width="170" frameborder="0" scrolling="0" style="width:170px; height: 30px;" allowTransparency="true"></iframe></td><td><iframe src="http://ghbtns.com/github-btn.html?user=netkiller&type=follow&count=true&size=large" height="30" width="240" frameborder="0" scrolling="0" style="width:240px; height: 30px;" allowTransparency="true"></iframe></td></tr></table><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp65640624"></a>14.3. 数据库开发规范</h2></div></div></div>
<div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="idp65641648"></a>14.3.1. 使用pdo_mysql替代mysql</h3></div></div></div>
<p>禁止通过字符串链接拼接sql语句，极容易出现注入漏洞</p>
<p>错误的写法:</p>
<pre class="screen">
$sql = "select * from table where id='".$id."'";
$sql = "INSERT INTO fruit(name, colour) VALUES ('".$name."', '".$colour."')";
</pre>
<p>$sql = "select * from table where id=".$id; 这种写法如果id没有做检查可以100%注入成功</p>
<p>正确的写法</p>
<pre class="screen">
$sql = "select * from table where id=?";
$sql = "INSERT INTO fruit(name, colour) VALUES (?, ?)";
</pre>
<p>使用“？”优势不便于我们排查调试有可能你传入的数字不对称，我们建议使用bindParam() 和 bindValue()</p>
<pre class="screen">
$sql = "select * from table where id = :id";
$sql = "INSERT INTO fruit(name, colour) VALUES (:name, :colour)";
</pre>
</div>
<div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="idp65646736"></a>14.3.2. 查询规范</h3></div></div></div>
<p>禁止使用 * 例如：</p>
<pre class="screen">
select * from member;
</pre>
<p>查询记录是否存在</p>
<pre class="screen">
select count(id) from member where username = :username
</pre>
</div>
<div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="idp65649424"></a>14.3.3. 结果集使用注意事项</h3></div></div></div>
<div class="sidebar"><div class="titlepage"><div><div><p class="title"><strong>返回数据库查询结果有几种形式</strong></p></div></div></div>
<p>数组形式</p>
<pre class="screen">
Array (
[0] => banana [1] => yellow
)
Array (
[NAME] => banana [COLOUR] => yellow
)
</pre>
<p>对象形式</p>
<pre class="screen">
Object (
Obj->NAME Obj->COLOUR
)
</pre>
<p>正确的使用方式</p>
<pre class="screen">
print($row['name']);
print($row->name);
</pre>
</div>
<p>错误的使用使方式</p>
<pre class="screen">
print($row[0]);
print($row[1]);
</pre>
<p>这种方式，有可能当数据库结构改变，增加字段，字段顺序发生变化，输出数据都会出错</p>
</div>
</div><div xmlns="" id="disqus_thread"></div><script xmlns="" type="text/javascript">
/* * * CONFIGURATION VARIABLES: EDIT BEFORE PASTING INTO YOUR WEBPAGE * * */
//if(document.domain == 'netkiller.github.com'){
var disqus_shortname = 'netkiller'; // required: replace example with your forum shortname
//}else{
//var disqus_shortname = 'neochan';
//}
/* * * DON'T EDIT BELOW THIS LINE * * */
(function() {
var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true;
dsq.src = 'http://' + disqus_shortname + '.disqus.com/embed.js';
(document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
})();
</script><noscript xmlns="">Please enable JavaScript to view the <a href="http://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript><a xmlns="" href="http://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a><br xmlns="" /><div xmlns="" id="clustrmaps-widget"></div><script xmlns="" type="text/javascript">var _clustrmaps = {'url' : 'http://netkiller.github.io', 'user' : 1107643, 'server' : '2', 'id' : 'clustrmaps-widget', 'version' : 1, 'date' : '2013-08-14', 'lang' : 'en', 'corners' : 'square' };(function (){ var s = document.createElement('script'); s.type = 'text/javascript'; s.async = true; s.src = 'http://www2.clustrmaps.com/counter/map.js'; var x = document.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x);})();</script><noscript xmlns=""><a href="http://www2.clustrmaps.com/user/87410e6bb"><img src="http://www2.clustrmaps.com/stats/maps-no_clusters/netkiller.github.io-thumb.jpg" alt="Locations of visitors to this page" /></a></noscript><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ch14s02.html">上一页</a> </td><td width="20%" align="center"><a accesskey="u" href="norm.html">上一级</a></td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">14.2. String </td><td width="20%" align="center"><a accesskey="h" href="index.html">起始页</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div><script xmlns="">
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-11694057-1', 'auto');
ga('send', 'pageview');
</script><script xmlns="" type="text/javascript">
var _bdhmProtocol = (("https:" == document.location.protocol) ? " https://" : " http://");
document.write(unescape("%3Cscript src='" + _bdhmProtocol + "hm.baidu.com/h.js%3F997cd4a7320a82d72cb74d179118f697' type='text/javascript'%3E%3C/script%3E"));
</script><script xmlns="" type="text/javascript" src="/js/q.js"></script></body></html>