码迷,mamicode.com
首页 > 数据库 > 详细

PDO方法,SQL注入攻击

时间:2016-06-27 11:54:14      阅读:170      评论:0      收藏:0      [点我收藏+]

标签:

<?php

//PDO:数据访问抽象层 //dsn:数据源: //带有事务功能: $dsn = "mysql:host=localhost;dbname=mydb"; //造pdo对象 $pdo = new PDO($dsn,"root","123"); //设置为异常模式 $pdo->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION );

try {  //写SQL语句  $sql = "insert into Nation values(‘n009‘,‘藏族‘)";  $sql1 = "insert into Nation values(‘n001‘,‘藏族‘)";  //$sql2 = "insert into Nation values(‘n012‘,‘藏族‘)";    //启动事务  $pdo->beginTransaction();    //执行SQL语句  $pdo->exec($sql);  $pdo->exec($sql1);  //$pdo->exec($sql2);    $pdo->commit(); } catch(PDOException $e) {  //echo $e->getMessage();  //回滚事务  $pdo->rollBack(); }

 

/*foreach($a as $v) {  var_dump($v); }*/

?>

<body> <?php

//2.可以防止SQL注入攻击 $dsn="mysql:host=localhost;dbname=mydb"; $pdo = new PDO($dsn,"root","123");

$sql = "insert into Nation values(?,?)";

//将一条SQL语句放到服务器等待执行 $stm = $pdo->prepare($sql);

/*//绑定参数 $stm->bindParam(1,$code); $stm->bindParam(2,$name);

//给变量赋值 $code = "n030"; $name = "哈空间";*/

$attr = array("n031","客户"); //执行预处理语句,执行成功返回true,执行失败返回false if($stm->execute($attr)) {  //var_dump($stm->fetch());  //var_dump($stm->fetchAll(PDO::FETCH_ASSOC)); }

 

?> </body>

PDO方法,SQL注入攻击

标签:

原文地址:http://www.cnblogs.com/naqiang/p/5619433.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!