标签:注入 copy informix get 占位符 offset post ram iss
1. 何为PDO?
<?php
$cat = isset ($_GET[‘cat‘]) ? $_GET[‘cat‘] : "1";
$pg = isset ($_GET[‘pg‘]) ? $_GET[‘pg‘] : "1";
$limit = 10;
$dbname = ‘shelf.sqlite‘;
try {
$db = new PDO("sqlite:" . $dbname);
$sth = $db->prepare(‘select * from book where cat_id=:id limit :offset, :limit‘, array (
PDO :: ATTR_CURSOR => PDO :: CURSOR_FWDONLY
));
$result = $sth->execute(array (
‘:id‘ => $cat,
‘:offset‘ => ($pg -1) * $limit,
‘:limit‘ => $limit
));
$list = array ();
$query = $db->query(‘select count(*) from book where cat_id=‘ . $cat)->fetch(); //Only 1 row
$list["count"] = $query[0];
if ($result) {
while ($row = $sth->fetch(PDO :: FETCH_ASSOC)) {
$list["books"][] = $row;
}
} else {
print_r($db->errorInfo());
}
$db = NULL;
echo str_replace(‘\\/‘, ‘/‘, json_encode($list));
} catch (PDOException $ex) {
print_r($ex);
}
?>
$query=$db->prepare(‘select * from book where cat_id=:id limit :offset, :limit‘, array (
PDO :: ATTR_CURSOR => PDO :: CURSOR_FWDONLY
));
<?php
$db = new PDO(‘mysql:host=localhost;dbname=test‘, $user, $pass);
//使用新建立的数据库连接。
//... ...
//连接在PDO实例的生命周期里是活动的。使用完毕后应当关闭此连接,若不这样做PHP在代码结束时才关闭此连接,将占用一部分内存。
$db = null;
?>
<?php
$db = new PDO(‘mysql:host=localhost;dbname=test‘, $user, $pass, array(
PDO::ATTR_PERSISTENT => true
));
?>
$sth = $db->prepare(‘select * from book where cat_id=:id limit :offset, :limit‘, array (
PDO :: ATTR_CURSOR => PDO :: CURSOR_FWDONLY
));
//用$limit1得到一个结果
$result1 = $sth->execute(array (
‘:id‘ => $cat,
‘:offset‘ => ($pg -1) * $limit1,
‘:limit‘ => $limit1
));
//用$limit2得到另一个结果
$result2 = $sth->execute(array (
‘:id‘ => $cat,
‘:offset‘ => ($pg -1) * $limit2,
‘:limit‘ => $limit2
));
//用位置参入参数
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (?, ?)");
$stmt->bindParam(1, $name);
$stmt->bindParam(2, $value);
//用名称传入参数
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(‘:name‘, $name);
$stmt->bindParam(‘:value‘, $value);
$name = ‘one‘;
$value = 1;
$stmt->execute();
/////////////////////////////////////////////
//也可以这样实现
//用位置参入参数,indexed array
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (?, ?)");
$name = ‘one‘;
$value = 1;
$stmt->execute(array($name,$value));
//用名称传入参数, associated array
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$name = ‘one‘;
$value = 1;
$stmt->execute(array(‘:name‘=>$name,‘:value‘=>$value));
// placeholder must be used in the place of the whole value
$stmt = $dbh->prepare("SELECT * FROM REGISTRY where name LIKE ?");
$stmt->execute(array("%$_GET[name]%"));
//下面这样就有问题了
$stmt = $dbh->prepare("SELECT * FROM REGISTRY where name LIKE ‘%?%‘");
$stmt->execute(array($_GET[‘name‘]));
标签:注入 copy informix get 占位符 offset post ram iss
原文地址:http://www.cnblogs.com/2833824328love/p/7258733.html