php 防止查询的sql攻击方法总结

$k = $_REQUEST['k'];

$k = addslashes($k);//转义:单引号，双引号，反斜线，NULL

$k = str_replace('%', '＼%', $k);

$k = str_replace('_', '＼_', $k);

$sql = "select * from users where name like '%$k%'";

if(!empty($k)){

$res = mysql_query($sql, $con) or die(mysql_error());

if($row = mysql_fetch_assoc($res)){

foreach($row as $k=>$v){

echo $row[$k].':'.$row[$v].'
';

}

}

}else{

echo '******';

}

 
$clean = array();
$mysql = array();
 
$clean['last_name'] = "O'Reilly";
$mysql['last_name'] = mysql_real_escape_string($clean['last_name']);
 
$sql = "INSERT
      INTO   user (last_name)
      VALUES ('{$mysql['last_name']}')";
 
?>

htmlentities($name,ENT_NOQUOTES,GB2312) 。