sqlsrv_query函数是否足以防止数据库注入？

Question

我正在尝试防止在我的第一个Web api上进行数据库注入，并且不确定使用sqlsrv_query函数是否足够。

Answer 1

Yes, you should be safe , provided that you:

• parameterize all user supplied values with ? placeholders
• provide values for each placeholder in $params in the correct order

Note however that this applies for values only - you cannot parameterize column names or table names in this way. In which case, you will need to perform validation such as whitelisting of permissible columns / tables etc.