php - 有没有办法同时添加 stripslashes 和 mysql 转义字符串来清理数据？

Question

我刚开始尝试学习 php 和 mysql，所以我的知识水平对两者都相当初级。

我不太确定 stripslashes 方法，所以我想知道下面的代码是否足够安全以防止对我的数据库进行 SQL 注入(inject)或其他恶意攻击？除了 stripslashes 方法之外，添加 mysql_real_escape_string 对数据库有好处吗？

$first = Trim(stripslashes($_POST['First']));
$last = Trim(stripslashes($_POST['Last']));
$city = Trim(stripslashes($_POST['City']));
$state = Trim(stripslashes($_POST['State']));
$country = Trim(stripslashes($_POST['Country']));
$email = Trim(stripslashes($_POST['Email']));
$tempt = $_POST['tempt'];
$tempt2 = $_POST['tempt2'];


if ($tempt == 'http://' && empty($tempt2)) {

    $error_message = '';
    $reg_exp = "/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9­-]+\.[a-zA-Z.]{2,5}$/";

    if(!preg_match($reg_exp, $email)) {

        $error_message .= "<p>A valid email address is required.</p>";
    }
    if (empty($first)) {
        $error_message .= "<p>Please provide your first name.</p>";
    }
    if (empty($last)) {
        $error_message .= "<p>Please provide your last name.</p>";
    }

    if (!empty($error_message)) {

        $return['error'] = true;
        $return['msg'] = "<p>The request was successful, but the form was not filled out correctly.</p>".$error_message;
        echo json_encode($return);
        exit();

    } else {

        $return['error'] = false;
        $return['msg'] = "<p style='top:9px; color:#ff6000; left:63px; text-align:left; font-size:1.50em;'>".$first .", <p style='top:0px; width:100%; left:63px; text-align:left; line-height:1.1em;'>your subscription request has been processed.</p>";
        echo json_encode($return);
    }

} else {

        $return['error'] = true;
        $return['msg'] = "<p>There was a problem while sending this form. Try it again.</p>";
        echo json_encode($return);
}

Answer 1

我创建了一个函数。只需传入要清理的值即可。

function clean($data) {
    $data = trim($data);
    $magic_quotes_active = get_magic_quotes_gpc();
    $new_enougth_php = function_exists("mysql_real_escape_string");
    if ($new_enougth_php) {
        if ($magic_quotes_active) {
            $value = stripslashes($data);
        }
        $value = mysql_real_escape_string($data);
    } else {
        if (!$magic_quotes_active) {
            $value = addcslashes($data);
        }
    }
    return $value;
}