php - pdo cheat sheet (ป้องกันการแฮกเว็บแบบ Sql injection)

  1. Config.php
  2. <?php
  3. $servername = "localhost";
  4. $username = "root";
  5. $password = "";
  6. $dbname = "pdoexample";
  7. try {
  8.  $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
  9.  $conn->exec("set names utf8");
  10. }catch(PDOException $e){
  11.     echo $e->getMessage();
  12. }
  13. ?>
  14. INSERT
  15. <?php require_once("config.php");
  16.  $str_name = "ทดสอบชื่อ1";
  17.  $str_username = "username1";
  18.  $str_password = md5("password1");
  19.     $stmt = $conn->prepare("INSERT INTO users (u_name, u_username, u_password) VALUES (?, ?, ?)");
  20.     $stmt->bindParam(1, $str_name);
  21.     $stmt->bindParam(2, $str_username);
  22.     $stmt->bindParam(3, $str_password);
  23. if($stmt->execute()){
  24.   $last_id = $conn->lastInsertId();
  25.   echo "insert success last id : ".$last_id;
  26.  }else{
  27.   echo "insert fail !";
  28.  }
  29. ?>
  30. UPDATE
  31. <?php require_once("config.php");
  32. if(isset($_GET["id"])){
  33.  $id = (int)$_GET["id"];
  34.  $name = "testname2";
  35.  $username = "testusername2";
  36.  $password = "testpassword2";
  37.  $stmt = $conn->prepare("UPDATE users SET u_name = ?, u_username = ?, u_password = ? WHERE u_id = ?");
  38.  $stmt->bindParam(1, $name);
  39.  $stmt->bindParam(2, $username);
  40.  $stmt->bindParam(3, $password);
  41.  $stmt->bindParam(4, $id);
  42.  $result = $stmt->execute();
  43.  if($result == true){
  44.   echo "update success";
  45.  }else{
  46.   echo "update fail !";
  47.  }
  48. }else{
  49.  echo "โปรดระบุไอดี";
  50. }
  51. ?>
  52. SELECT
  53. <?php require_once("config.php");
  54. if(isset($_GET["id"])){
  55.    $id = (int)$_GET["id"];
  56.    $stmt = $conn->prepare('SELECT u_id, u_name, u_username, u_password FROM users WHERE u_id = ?');
  57.    $stmt->bindParam(1, $id);
  58.    $stmt->execute();
  59.    $result = $stmt->fetchAll();
  60.     foreach ($result as $r){
  61.      echo $r["u_id"]."<br>";
  62.      echo $r["u_name"]."<br>";
  63.      echo $r["u_username"]."<br>";
  64.      echo $r["u_password"]."<br>";
  65.    }
  66. }else{
  67.  echo "โปรดระบุ id";
  68. }
  69. ?>
  70. DELETE
  71. <?php require_once("config.php");
  72. if(isset($_GET["id"])){
  73.  $id = (int)$_GET["id"];
  74.  $stmt = $conn->prepare("DELETE FROM users WHERE u_id= ?");
  75.  $stmt->bindParam(1, $id);
  76.  $result = $stmt->execute();
  77.  if($result == true){
  78.   echo "delete success";
  79.  }else{
  80.   echo "delete fail !";
  81.  }
  82. }else{
  83.  echo "โปรดระบุไอดี";
  84. }
  85. ?>