网站登录是否可以保护网站免受SQL注入？

Question

I have secure site with a login before anyone can enter the site and submit any form data. Is this secure enough from SQL injection?

Answer 1

NO!

It makes it vulnerable (if not done properly. Well as vulnerable as everything after the login).

Since hackers can use the form to inject sql.

A login != slq injection protection.

Sanitizing user input is.

Use for example:

mysql_real_escape_string()

mysqli_real_escape_string()

pdo's prepared statements

Answer 2

NO

SQL Injection has nothing to do with authentication; it has to do with the way you sanitize user input. In other words, a user with perfectly good credentials may have bad intention and decide that he'd want to try and drop your database by entering malicious text on some of your form's fields.

On PHP, you can use mysql_real_escape_string() to sanitize your input and form your SQL statements via string concatenation but if you can implement prepared statements (also known as parametrized queries) much better since your query plans may be reused and you gain a performance boost as well.

Answer 3

Not if the user uses sql injection on your logon form. How does the logon form work. If it checks using a select then you still need to strip out bad sql etc.

Answer 4

用您的术语来说是“ 祖父悖论” ，如果您的登录确实提供了对sql注入的保护，那么登录页面上的用户就不会登录。顺便说一句，授权/身份验证和sql注入都是无关的事情，所以您的回答是“ 否” 。