{"id":1272,"date":"2026-01-06T17:31:58","date_gmt":"2026-01-06T09:31:58","guid":{"rendered":"https:\/\/www.52runoob.com\/?p=1272"},"modified":"2026-01-06T17:31:58","modified_gmt":"2026-01-06T09:31:58","slug":"php%e4%b8%ad%e9%98%b2sql%e6%b3%a8%e5%85%a5%e7%9a%84%e4%b8%bb%e8%a6%81%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"https:\/\/www.52runoob.com\/index.php\/2026\/01\/06\/php%e4%b8%ad%e9%98%b2sql%e6%b3%a8%e5%85%a5%e7%9a%84%e4%b8%bb%e8%a6%81%e6%96%b9%e6%b3%95\/","title":{"rendered":"PHP\u4e2d\u9632SQL\u6ce8\u5165\u7684\u4e3b\u8981\u65b9\u6cd5"},"content":{"rendered":"\n

SQL \u6ce8\u5165<\/strong>\uff08SQL Injection\uff09\u662f\u4e00\u79cd\u5e38\u89c1\u7684 Web \u5b89\u9669\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u901a\u8fc7\u6076\u610f\u6784\u9020 SQL \u67e5\u8be2\u8bed\u53e5\uff0c\u4ece\u800c\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u3001\u8bfb\u53d6\u3001\u4fee\u6539\u6216\u5220\u9664\u6570\u636e\u5e93\u4e2d\u7684\u6570\u636e\uff0c\u751a\u81f3\u53ef\u4ee5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\u3002<\/p>\n\n\n\n

\u5728 PHP \u4e2d\u9632\u6b62 SQL \u6ce8\u5165\u6709\u5f88\u591a\u6709\u6548\u7684\u65b9\u6cd5\u3002\u4ee5\u4e0b\u662f \u4e3b\u8981\u7684\u9632\u6b62 SQL \u6ce8\u5165\u7684\u6280\u672f\u4e0e\u7b56\u7565<\/strong>\u3002<\/p>\n\n\n\n

\n\n\n\n

\u4e00\u3001\u4f7f\u7528 \u9884\u5904\u7406\u8bed\u53e5<\/strong>\uff08Prepared Statements\uff09<\/h2>\n\n\n\n

\u63a8\u8350\u65b9\u6cd5\uff1a<\/strong><\/h3>\n\n\n\n

\u4f7f\u7528 PDO<\/strong> \u6216 MySQLi<\/strong> \u63d0\u4f9b\u7684 \u9884\u5904\u7406\u8bed\u53e5<\/strong>\uff0c\u5b83\u53ef\u4ee5\u786e\u4fdd SQL \u67e5\u8be2\u548c\u7528\u6237\u8f93\u5165\u7684\u5185\u5bb9\u662f\u5206\u79bb\u7684\uff0c\u6781\u5927\u5730\u51cf\u5c11\u4e86 SQL \u6ce8\u5165\u7684\u98ce\u9669\u3002<\/p>\n\n\n\n

1\ufe0f\u20e3 PDO \u793a\u4f8b<\/strong>\uff08\u63a8\u8350\uff09<\/h3>\n\n\n\n

\u6b65\u9aa4\uff1a<\/strong><\/p>\n\n\n\n

    \n
  • \u4f7f\u7528 prepare()<\/code> \u65b9\u6cd5\u51c6\u5907 SQL \u8bed\u53e5\u3002<\/li>\n\n\n\n
  • \u4f7f\u7528 bindParam()<\/code> \u6216 bindValue()<\/code> \u65b9\u6cd5\u7ed1\u5b9a\u53c2\u6570\uff0c\u907f\u514d\u7528\u6237\u8f93\u5165\u76f4\u63a5\u8fdb\u5165 SQL \u67e5\u8be2\u4e2d\u3002<\/li>\n<\/ul>\n\n\n\n

    \u793a\u4f8b\uff1a<\/strong><\/p>\n\n\n

    \n&lt;?php\ntry {\n    \/\/ \u521b\u5efa PDO \u5b9e\u4f8b\uff0c\u8fde\u63a5\u5230 MySQL \u6570\u636e\u5e93\n    $pdo = new PDO('mysql:host=localhost;dbname=test', 'root', '');\n    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);\n    \n    \/\/ \u4f7f\u7528\u9884\u5904\u7406\u8bed\u53e5\n    $stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");\n    \n    \/\/ \u7ed1\u5b9a\u7528\u6237\u8f93\u5165\u7684\u53c2\u6570\n    $stmt->bindParam(':username', $username, PDO::PARAM_STR);\n    $stmt->bindParam(':password', $password, PDO::PARAM_STR);\n    \n    \/\/ \u8bbe\u7f6e\u5b9e\u9645\u7684\u8f93\u5165\u503c\n    $username = $_POST['username'];\n    $password = $_POST['password'];\n    \n    \/\/ \u6267\u884c SQL \u67e5\u8be2\n    $stmt->execute();\n    \n    \/\/ \u83b7\u53d6\u67e5\u8be2\u7ed3\u679c\n    $result = $stmt->fetch(PDO::FETCH_ASSOC);\n    \n    if ($result) {\n        echo "Login successful!";\n    } else {\n        echo "Invalid username or password!";\n    }\n} catch (PDOException $e) {\n    echo "Error: " . $e->getMessage();\n}\n?>\n\n<\/pre><\/div>\n\n\n
    \u89e3\u91ca\uff1a<\/strong><\/p>\n\n\n\n
      \n
    • prepare()<\/code> \u65b9\u6cd5\u5c06 SQL \u67e5\u8be2\u8bed\u53e5\u548c\u7528\u6237\u8f93\u5165\u5206\u5f00\uff0c\u907f\u514d SQL \u6ce8\u5165\u3002<\/li>\n\n\n\n
    • \u4f7f\u7528 bindParam()<\/code> \u6216 bindValue()<\/code> \u5c06\u53c2\u6570\u7ed1\u5b9a\u5230\u67e5\u8be2\u4e2d\uff0cPDO \u4f1a\u81ea\u52a8\u5904\u7406\u8f6c\u4e49\u548c\u7c7b\u578b\u5b89\u5168\u3002<\/li>\n<\/ul>\n\n\n\n
      2\ufe0f\u20e3 MySQLi \u793a\u4f8b<\/strong>\uff08\u652f\u6301\u9762\u5411\u5bf9\u8c61\u548c\u8fc7\u7a0b\u5316\u98ce\u683c\uff09<\/h3>\n\n\n
      \n&lt;?php\n\/\/ \u4f7f\u7528 MySQLi \u8fde\u63a5\u6570\u636e\u5e93\n$mysqli = new mysqli("localhost", "root", "", "test");\n\n\/\/ \u68c0\u67e5\u8fde\u63a5\u662f\u5426\u6210\u529f\nif ($mysqli->connect_error) {\n    die("Connection failed: " . $mysqli->connect_error);\n}\n\n\/\/ \u4f7f\u7528\u9884\u5904\u7406\u8bed\u53e5\n$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ? AND password = ?");\n$stmt->bind_param("ss", $username, $password);\n\n\/\/ \u83b7\u53d6\u7528\u6237\u8f93\u5165\u7684\u53c2\u6570\n$username = $_POST['username'];\n$password = $_POST['password'];\n\n\/\/ \u6267\u884c\u67e5\u8be2\n$stmt->execute();\n\n\/\/ \u83b7\u53d6\u7ed3\u679c\n$result = $stmt->get_result();\n\nif ($result->num_rows > 0) {\n    echo "Login successful!";\n} else {\n    echo "Invalid username or password!";\n}\n\n\/\/ \u5173\u95ed\u8fde\u63a5\n$stmt->close();\n$mysqli->close();\n?>\n\n<\/pre><\/div>\n\n\n
      \u89e3\u91ca\uff1a<\/strong><\/p>\n\n\n\n
        \n
      • \u901a\u8fc7 prepare()<\/code> \u548c bind_param()<\/code>\uff0cMySQLi \u4e5f\u786e\u4fdd\u7528\u6237\u8f93\u5165\u4e0e SQL \u8bed\u53e5\u5206\u79bb\uff0c\u9632\u6b62\u4e86 SQL \u6ce8\u5165\u3002<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        \u4e8c\u3001\u4f7f\u7528 \u53c2\u6570\u5316\u67e5\u8be2<\/strong>\uff08Parameterized Queries\uff09<\/h2>\n\n\n\n
        \u901a\u8fc7\u5c06\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u53c2\u6570\u800c\u4e0d\u662f\u76f4\u63a5\u62fc\u63a5\u5728 SQL \u8bed\u53e5\u4e2d\uff0c\u53ef\u4ee5\u907f\u514d SQL \u6ce8\u5165\u653b\u51fb\u3002<\/p>\n\n\n\n
        \u793a\u4f8b\uff1a<\/strong><\/h3>\n\n\n
        \n&lt;?php\n\/\/ \u4f7f\u7528 MySQLi \u6267\u884c\u53c2\u6570\u5316\u67e5\u8be2\n$query = "SELECT * FROM users WHERE username = :username AND password = :password";\n$stmt = $db->prepare($query);\n\n$stmt->bindParam(':username', $_POST['username']);\n$stmt->bindParam(':password', $_POST['password']);\n\n$stmt->execute();\n?>\n\n<\/pre><\/div>\n\n\n
        \u89e3\u91ca\uff1a<\/strong><\/p>\n\n\n\n