問題描述
如果通過 GET 傳遞參數，則可以進行 Sql 注入.但是也可以通過POST.如果是，https 可以阻止嗎?
Sql Injection is possible if parameters are passed via GET. But is it possible via POST also. If yes, can https prevent it?
推薦答案
是的，可以使用 $_POST 以及 $_GET、$_COOKIE 和 $_REQUEST.HTTPS 根本不會保護您.您必須使用某些功能來保護您，例如 mysql_real_escape_string 或使用 準備好的語句.
Yes, it's possible with $_POST as well as with $_GET, $_COOKIE and $_REQUEST. HTTPS will not protect you at all. You have to use some function to protect you, for example mysql_real_escape_string or use prepared statements.
來自網絡瀏覽器的所有通信都應作為不受信任"處理.您不能信任的其他技術是 Ajax、文件上傳 和 JavaScript 表單驗證(等等).所有這些數據都直接來自網絡瀏覽器，在您過濾或驗證數據之前不應信任它們.
All communication from the web browser should be handled as "untrusted". Other techniques you can't trust is Ajax, file uploads and JavaScript form validations (among others). All these data come directly from the web browser and should not be trusted before you have filtered them or validated the data.
您唯一可以信任的是 $_SESSION，前提是您只將經過驗證的數據放入您的 $_SESSION 變量中.
The only thing you can trust is $_SESSION, provided that you ONLY put in validated data into your $_SESSION variables.
這篇關于POST 是否可以進行 SQL 注入?的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！