在 MySQLi 上使用 bind_param() 时是否需要转义数据以防止 SQL 注入?
正如标题所说，我在使用 bind_param() 时是否必须转义用户输入，还是在内部完成?
As the title says, do I have to escape user input when using bind_param() or is that done internally?
谢谢.
推荐答案
不需要，绑定参数时不需要转义数据以防止 SQL 注入.
No, you do not need to escape data to protect against SQL injection when binding parameters.
但这并不能免除您验证所述数据的责任.
This does not absolve you from validating said data though.
绑定参数时，不执行转义(内部或其他方式).使用参数占位符准备 SQL 语句，并在执行时传递这些参数的值.
When binding parameters, there is no escaping performed (internally or otherwise). An SQL statement is prepared with parameter placeholders and values for these are passed at execution time.
数据库知道什么是参数并相应地处理它们，而不是 SQL 值插值.
The database knows what parameters are and treats them accordingly as opposed to SQL value interpolation.
相关文章