sql注入

分页参数怎么防止SQL注入

小新
133
2021-01-06 19:37:05
栏目: 编程语言

分页参数怎么防止SQL注入

分页参数防止SQL注入的方法:

对任何输入信息都必须进行参数过滤,php实例:

$this->load->library ( 'pagination' );

$config ['base_url'] = site_url () . '/guest/show';

$config ['total_rows'] = $c;

$config ['per_page'] = $pernum = 15;

$config ['uri_segment'] = 3;

$config ['use_page_numbers'] = TRUE;

$config ['first_link'] = '第一页';

$config ['last_link'] = '最后一页';

$config ['num_links'] = 5;

$this->pagination->initialize ( $config );

if (! $this->uri->segment ( 3 )) {

$currentnum = 0;

} else {

$currentnum = is_numeric($this->uri->segment ( 3 ))?(intval($this->uri->segment ( 3 ) - 1)) * $pernum:0;

}

$current_page=is_numeric($this->uri->segment ( 3 ))?intval($this->uri->segment ( 3 )):1;

if($current_page){

$data ['title'] = '第'.$current_page.'页-留言本-防SQL注入测试';

}

else{

$data ['title'] = '留言本-防SQL注入测试';

}

$data ['liuyan'] = $this->ly->getLy ( $pernum, $currentnum );

其中以下这两句判断了参数是否为数字,防止非法字符输入。

$current_page=is_numeric($this->uri->segment ( 3 ))?intval($this->uri->segment ( 3 )):1;

$currentnum = is_numeric($this->uri->segment ( 3 ))?(intval($this->uri->segment ( 3 ) - 1)) * $pernum;

0
看了该问题的人还看了