How to sanitize input with PHP and the sqlsrv driver?

问题

I'm working on a PHP MSSQL project that is using the sqlsrv driver. What's the best way to stop SQL injection attacks? I need something like mysql_real_escape_string() but for sqlsrv driver.

回答1:

The best way is not to write your SQL so that you need to use an analogue of mysql_real_escape_string(), which you would do by using placeholders for the values and then passing the variables (that would otherwise have been handled by mysql_real_escape_string()) when you execute the statement or open the cursor or whatever.

Failing that, look at the output of mysql_real_escape_string(); it might be appropriate for MS SQL Server too. It depends on how it does the escaping (and what escaping it does).

回答2:

If you use it like this, quoting is automatic:

$sql = "exec usp_cis_upd
        @key = ?,
        @value = ?";

$params = array(
    $key,
    trim($_POST["value"]));

$stmt = sqlsrv_query($dbh, $sql, $params);

来源：https://stackoverflow.com/questions/7604036/how-to-sanitize-input-with-php-and-the-sqlsrv-driver