— 易受攻击的代码
— 直接拼接SQL语句
$username = $_POST[‘username’];
$password = $_POST[‘password’];

$sql = “SELECT * FROM fgedu_users WHERE username = ‘$username’ AND password = ‘$password'”;

— 安全的代码
— 使用参数化查询
$stmt = $pdo->prepare(‘SELECT * FROM fgedu_users WHERE username = :username AND password = :password’);
$stmt->bindParam(‘:username’, $username);
$stmt->bindParam(‘:password’, $password);
$stmt->execute();

— Python中使用预处理语句
import psycopg2

conn = psycopg2.connect(
host=”fgedu.net.cn”,
database=”fgedudb”,
user=”fgedu”,
password=”your_password”
)

cur = conn.cursor()

# 使用预处理语句
cur.execute(“SELECT * FROM fgedu_users WHERE username = %s AND password = %s”, (username, password))

# 执行

# 输出日志
# 安全执行，不会受到SQL注入攻击

— 输入验证示例
function validate_input($input) {
// 移除HTML标签
$input = strip_tags($input);
// 转义特殊字符
$input = htmlspecialchars($input);
// 去除首尾空格
$input = trim($input);
return $input;
}

// 使用示例
$username = validate_input($_POST[‘username’]);
$password = validate_input($_POST[‘password’]);

// 然后使用参数化查询
$stmt = $pdo->prepare(‘SELECT * FROM fgedu_users WHERE username = :username AND password = :password’);
$stmt->bindParam(‘:username’, $username);
$stmt->bindParam(‘:password’, $password);
$stmt->execute();

— 易受攻击的登录代码
0) {
echo “登录成功”;
} else {
echo “登录失败”;
}
?>

— 攻击示例
— 输入用户名: admin’ —
— 输入密码: 任意值

— 生成的SQL语句
SELECT * FROM fgedu_users WHERE username = ‘admin’ –‘ AND password = ‘任意值’

— 执行结果
— 成功登录admin账户，无需正确密码

— 安全的登录代码
prepare(‘SELECT * FROM fgedu_users WHERE username = :username AND password = :password’);
$stmt->bindParam(‘:username’, $username);
$stmt->bindParam(‘:password’, $password);
$stmt->execute();

// 检查结果
if ($stmt->rowCount() > 0) {
echo “登录成功”;
} else {
echo “登录失败”;
}
?>

— 攻击示例
— 输入用户名: admin’ —
— 输入密码: 任意值

— 生成的SQL语句
SELECT * FROM fgedu_users WHERE username = ‘admin” –‘ AND password = ‘任意值’

— 执行结果
— 登录失败，因为参数被当作普通字符串处理