如何使用PHP和sqlsrv驱动程序清理输入？

Question

I'm working on a PHP MSSQL project that is using the sqlsrv driver. What's the best way to stop SQL injection attacks? I need something like mysql_real_escape_string() but for sqlsrv driver.

Answer 1

If you use it like this, quoting is automatic:

$sql = "exec usp_cis_upd
        @key = ?,
        @value = ?";

$params = array(
    $key,
    trim($_POST["value"]));

$stmt = sqlsrv_query($dbh, $sql, $params);

Answer 2

The best way is not to write your SQL so that you need to use an analogue of mysql_real_escape_string() , which you would do by using placeholders for the values and then passing the variables (that would otherwise have been handled by mysql_real_escape_string() ) when you execute the statement or open the cursor or whatever.

Failing that, look at the output of mysql_real_escape_string() ; it might be appropriate for MS SQL Server too. It depends on how it does the escaping (and what escaping it does).