PHP 在LIKE查询中阻止sql注入

Posted 2021-05-14

<?php
function escapeLike($mysql, $data)
{
	if(is_int($data) || is_float($data)) return $data;
	
	$escaped = $mysql->real_escape_string($data);
	$find = array('%' => '\\%', '_' => '\\_');
	return strtr($escaped, $find);
}

//Usage

$dangerous_input = '%My Name';

//$mysql has to be either an instance of mysql or mysqli
$query = "SELECT * FROM tbl WHERE field LIKE '" . escapeLike($mysql, $dangerous_input) . "%'";
echo $query; //Echoes: SELECT * FROM tbl WHERE field LIKE '\%My Name%'
?>