web安全知识

$username = ‘root‘;
$password = ‘1234abcd‘;
$driver_options = array(
    PDO::MYSQL_ATTR_INIT_COMMAND    => ‘SET NAMES UTF8‘,
    );
$pdo = new PDO($dsn, $username, $password, $driver_options);
//1.编译统一的结构
$sql = "insert into team values (null, :team_name)";
$stmt = $pdo->prepare($sql);
$data_list = array(
    array(‘name‘=>‘国安‘),
    array(‘name‘=>‘绿地‘),
    array(‘name‘=>‘恒大‘),
    array(‘name‘=>‘建业‘),
    array(‘name‘=>‘鲁能‘),
    array(‘name‘=>‘申花‘),
    );
foreach($data_list as $row) {
    //2.绑定数据到中间编译结果
    $stmt->bindValue(‘:team_name‘, $row[‘name‘]);

    //3.执行
    $result = $stmt->execute();
    var_dump($result);
}

function prepare( $query, $args ) {
    if ( is_null( $query ) )
         return;

    // This is not meant to be foolproof -- 
           but it will catch obviously incorrect usage.
    if ( strpos( $query, ‘%‘ ) === false ) {
         _doing_it_wrong( ‘wpdb::prepare‘ , 
         sprintf ( __( ‘The query argument of %s
                 must have a placeholder.‘ ), ‘wpdb::prepare()‘ ), ‘3.9‘ );
   }

    $args = func_get_args();
    array_shift( $args );
    // If args were passed as an array (as in vsprintf), move them up
    if ( isset( $args[ 0] ) && is_array( $args[0]) )
         $args = $args [0];
    $query = str_replace( "‘%s‘", ‘%s‘ , $query ); 
        // in case someone mistakenly already singlequoted it
    $query = str_replace( ‘"%s"‘, ‘%s‘ , $query ); 
        // doublequote unquoting
    $query = preg_replace( ‘|(?<!%)%f|‘ , ‘%F‘ , $query ); 
        // Force floats to be locale unaware
    $query = preg_replace( ‘|(?<!%)%s|‘, "‘%s‘" , $query ); 
        // quote the strings, avoiding escaped strings like %%s
    array_walk( $args, array( $this, ‘escape_by_ref‘ ) );
    return @ vsprintf( $query, $args );
}