华为云国际站代理商：防sql注入代码

防止SQL注入是一项重要的安全措施。通过使用参数化查询和准备语句可以有效地防止SQL注入攻击。以下是一些示例代码，展示如何在不同编程语言中防止SQL注入：

PHP (使用PDO)

<?php
$dsn = 'mysql:host=your_host;dbname=your_db';
$username = 'your_username';
$password = 'your_password';

try {
    $pdo = new PDO($dsn, $username, $password);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    $stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
    $stmt->bindParam(':username', $username, PDO::PARAM_STR);

    $username = $_GET['username'];
    $stmt->execute();

    $result = $stmt->fetchAll();
    foreach ($result as $row) {
        print_r($row);
    }
} catch (PDOException $e) {
    echo 'Connection failed: ' . $e->getMessage();
}
?>

Java (使用PreparedStatement)

import java.sql.*;

public class SQLInjectionPrevention {
    public static void main(String[] args) {
        String url = "jdbc:mysql://your_host:3306/your_db";
        String user = "your_username";
        String password = "your_password";

        try (Connection conn = DriverManager.getConnection(url, user, password)) {
            String query = "SELECT * FROM users WHERE username = ?";
            PreparedStatement pstmt = conn.prepareStatement(query);
            pstmt.setString(1, "some_username");

            ResultSet rs = pstmt.executeQuery();
            while (rs.next()) {
                System.out.println("User: " + rs.getString("username"));
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}

Python (使用sqlite3模块)

import sqlite3

connection = sqlite3.connect('your_database.db')
cursor = connection.cursor()

username = 'some_username'
cursor.execute('SELECT * FROM users WHERE username = ?', (username,))

rows = cursor.fetchall()
for row in rows:
    print(row)

connection.close()

C# (使用SqlCommand)

using System;
using System.Data.SqlClient;

class Program
{
    static void Main()
    {
        string connectionString = "Data Source=your_server;Initial Catalog=your_database;User ID=your_username;Password=your_password";
        using (SqlConnection connection = new SqlConnection(connectionString))
        {
            string query = "SELECT * FROM users WHERE username = @username";
            SqlCommand command = new SqlCommand(query, connection);
            command.Parameters.AddWithValue("@username", "some_username");

            connection.Open();
            SqlDataReader reader = command.ExecuteReader();
            while (reader.Read())
            {
                Console.WriteLine("User: " + reader["username"]);
            }
        }
    }
}

总结

上述代码示例展示了如何在不同编程语言中使用参数化查询来防止SQL注入攻击。通过使用参数化查询和准备语句，可以确保输入数据被正确地转义，从而避免恶意SQL代码的执行。