Parameterized Query

问题:

Pls is this code secure?

/* Create a new mysqli object with database connection parameters */
$mysqli = new mysql('localhost', 'username', 'password', 'db');

if(mysqli_connect_errno()) {
echo "Connection Failed: " . mysqli_connect_errno();
exit();
}

/* Create a prepared statement */
if($stmt = $mysqli -> prepare("SELECT priv FROM testUsers WHERE username=?
AND password=?")) {

/* Bind parameters
s - string, b - boolean, i - int, etc */
$stmt -> bind_param("ss", $user, $pass);

/* Execute it */
$stmt -> execute();

/* Bind results */
$stmt -> bind_results($result);

/* Fetch the value */
$stmt -> fetch();

echo $user . "'s level of priviledges is " . $result;

/* Close statement */
$stmt -> close();
}

/* Close connection */
$mysqli -> close();

回答1:

As far as protection against mySQL injection is concerned: Yes. Mysqli's parametrized queries are safe against injection attacks.

If $user comes from an external source, you may want to add htmlentities() the echo statement to prevent users from signing up with a user name like <script>(some malicious code)</script>

回答2:

The call per se is secure. You might want to put this $mysqli = new mysql('localhost', 'username', 'password', 'db'); in a separate file, though, outside your public web directory.

回答3:

Addition to Pekka's comment: also use htmlspecialchars on $result in the echo statement.