什么时候需要mysql_real_escape_string（）？

Question

是否仅在登录页面或登录后的每个mysql_query需要带sprintf mysql_real_escape_string()才能防止SQL注入？

Answer 1

You should use mysql_real_escape_string() every time you insert user-posted data into a query, or use a database wrapper like PDO that can do prepared statements. That would be better, because they do the job of sanitizing for you.

If you are working on the overall security of your site, this is great and definitely necessary. If you are looking for reasons why your site was hacked, though, I doubt this was done through a SQL injection, as your actual HTML code was affected (or so I thought, I may be wrong). This would be only possible if you had your FTP password stored somewhere in the database.

Answer 2

对于将通过SQL查询运行的任何用户提供的数据，都应使用mysql_real_escape_string。

Answer 3

Use it when you do not trust the input . And never trust a user input.

Answer 4

In any instance that you accept user input, you should use mysqli_real_escape_string on it before sending it to the database. It is a good idea to use trim() on the input as well.