使用 PHP 表单清理数据库输入 - Database input sanitisation with PHP forms

Database input sanitisation with PHP forms

本文关键字：数据库输入 PHP 表单使用 | 更新日期: 2023-09-27

我通过以下方式清理从表单接收的数据：

$gender = filter_var($_POST['gender'], FILTER_SANITIZE_STRING);
$firstName = filter_var($_POST['firstName'], FILTER_SANITIZE_STRING);
$lastName = filter_var($_POST['lastName'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
$message = filter_var($_POST['comment'], FILTER_SANITIZE_STRING);
$address = filter_var($_POST['address'], FILTER_SANITIZE_STRING);
$numBrochures = (int) filter_var($_POST['quantity'], FILTER_SANITIZE_NUMBER_INT);

插入数据的相关 SQL 查询如下所示：

if (mysqli_query($conn, "INSERT INTO users(firstName, lastName, email, gender) VALUES('$firstName', '$lastName', '$email', '$gender')") == TRUE) {
  logSuccess($file, "Adding user");
}
else {
  logError($file, "Adding user", mysqli_error($conn));
}
$userId = $conn->query("SELECT `userId` FROM users WHERE `firstName` = '$firstName' AND `lastName` = '$lastName' AND `email` = '$email'")->fetch_object()->userId;
if ($userId == false) {
  logError($file, "Fetching user id", mysqli_error($conn));
}
if (mysqli_query($conn, "INSERT INTO brochureOrders(userId, address, numBrochures, message) VALUES('$userId', '$address', '$numBrochures', '$message')") == TRUE) {
  logSuccess($file, "Brochure Order");
  $sendConfirmationEmail = true;
}
else {
  logError($file, "Brochure Order", mysqli_error($conn));
}

但是，在我的数据库中，我看到如下条目：

address = "vz8y8E  gghwptvvzuak, [url=http://ytvsmximkjnp.com/]ytvsmximkjnp[/url], [link=http://hiabgyvsjifp.com/]hiabgyvsjifp[/link], http://tyvylndqitoy.com/"

以下不应该照顾到这一点吗？

$address = filter_var($_POST['address'], FILTER_SANITIZE_STRING);

有人可以告诉我我在这里做错了什么吗？

因为OP在评论中说他想切换到准备好的陈述，我想我会给他看一个例子。

而不是这样的东西：

if (mysqli_query($conn, "INSERT INTO users(firstName, lastName, email, gender) VALUES('$firstName', '$lastName', '$email', '$gender')") == TRUE) {
  logSuccess($file, "Adding user");
}
else {
  logError($file, "Adding user", mysqli_error($conn));
}

做这样的事情：

$query = "INSERT INTO users (firstName, lastName, email, gender) VALUES(?, ?, ?, ?)";
if($stmt = $mysqli->prepare($query)){
    $stmt->bind_param('ssss', $firstName, $lastName, $email, $gender);
    $stmt->exeucte();
    $stmt->close();
}else die("Failed to prepare!");

而这个

$query = "SELECT `userId` FROM users WHERE `firstName` = ? AND `lastName` = ? AND `email` = ?";
if($stmt = $mysqli->prepare($query)){
    $stmt->bind_param('sss', $firstName, $lastName, $email);
    $stmt->execute();
    $stmt->bind_result($userId);
    $stmt->fetch();
    $stmt->close()
}else die("Failed to prepare!");