防止类似查询中的sql注入

Posted 2021-02-24

Function to prevent sql injection in Like queries, where the characters '_' and '%' can be dangerous.

<?php
function escapeLike($mysql, $data)
{
	if(is_int($data) || is_float($data)) return $data;
 
	$escaped = $mysql->real_escape_string($data);
	$find = array('%' => '\%', '_' => '\_');
	return strtr($escaped, $find);
}
 
//Usage
 
$dangerous_input = '%My Name';
 
//$mysql has to be either an instance of mysql or mysqli
$query = "SELECT * FROM tbl WHERE field LIKE '" . escapeLike($mysql, $dangerous_input) . "%'";
echo $query; //Echoes: SELECT * FROM tbl WHERE field LIKE '\%My Name%'
?>