使用 SQL 保护 php GET [重复]

Question

任何建议我如何保护下面的 GET 代码以防止 SQL 注入或任何黑客活动？

http://localhost/hobby.php?hobby=soccer

<?php

include "connect.php";


$hobby = (isset($_GET['hobby'])) ? $_GET['hobby'] : '';
$hobby = str_replace("'", "''", $hobby);

$hobby = strip_tags($hobby);
$hobby = trim ($hobby);

if ($hobby != '') {
    
    $sql = "SELECT Name, Hobby from myself where Hobby like '%$hobby%'";

    $stmt = sqlsrv_query( $conn, $sql );
    
    $result = array();
    $row_check = sqlsrv_has_rows( $stmt );


    if ($row_check == true) {
        while ($row = sqlsrv_fetch_array( $stmt, SQLSRV_FETCH_ASSOC)) {
            $result['Response'][] = array(
        'Name' => $row['Name'],
        'Hobby' => $row['Hobby']
            );
        }
    } 
    sqlsrv_free_stmt( $stmt);
    sqlsrv_close( $conn);
?>

Answer 1

最好的办法是按照@giacomo-m 的建议使用 PDO

php.net/manual/en/book.pdo.php