和网站安全密切相关的引号

SQL注入

示例代码

$username = $_GET['username'];
$password = $_GET['password'];
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

username=alice'; DROP TABLE users; --
password=secret

SELECT * FROM users WHERE username = 'alice'; DROP TABLE users; --' AND password = 'secret'

跨站脚本（XSS）

echo "<p>Welcome, " . $_GET['username'] . "</p>";

username=<script>alert('XSS');</script>

<p>Welcome, <script>alert('XSS');</script></p>

JavaScript 注入

var username = <?php echo json_encode($_GET['username']); ?>;
console.log(username);

username='alert("XSS");'

解决方法

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);

echo htmlspecialchars($username);

echo json_encode($username);

最小权限原则