使用存储过程而不是查询可以避免 SQL 注入吗？

Question

这里是新手。我一直在研究 SQLSVR 如何利用准备好的语句来防止注入，但它们所防止的通常是查询本身，而不是诸如存储过程之类的东西。我当前的代码是否可以避免这种情况？

我一直在尝试理解这里的 PHP 手册：https://www.php.net/manual/en/function.sqlsrv-query.php但我不太确定这会是什么样子，因为我正在使用存储过程。

感谢您花时间阅读本文和指导。

<?php 

include('config.php');

$mysqli = sqlsrv_connect($serverName, $conn_array);

// For error or success messages place the following functions in your functions.php file and include the file here.

// The following functions are based on bootstrap classes for error and success message. If you are not using bootstrap you can stylize your own.

function alertSuccess($msg){

  $alert = "<div class='alert alert-success'>".$msg."</div>";

  return $alert;

}

function alertError($msg){

  $alert = "<div class='alert alert-danger'>".$msg."</div>";

  return $alert;

}

function alertInfo($msg){

  $alert = "<div class='alert alert-info'>".$msg."</div>";

  return $alert;

}

// Storing Form Inputs

$username = ($_POST['username']);

$email = ($_POST['email']);

$region =($_POST['region']);

$password = (!empty($_POST['password']))?$_POST['password']:null;

$password2 = (!empty($_POST['confirmpassword']))?$_POST['confirmpassword']:null;

if(isset($_POST['register'])) {

  // Set "Creating Account" message. 

  echo alertInfo("Attempting to initiate Account Creation...");

  // If username is null then rest of the code will not be executed

  if($username == null){

    echo alertError("Invalid username!");

    header("Location: failed.php");

    exit();

  }

  // If password is not equal then rest of the code will not be executed

  if($password != $password2){

    echo alertError("Password mismatch");

    header("Location: failed.php");

    exit();

  }

  // If username is less than 6 characters long then rest of the code will not be executed

  if(strlen($username) < 6){

    echo alertError("Username must contain at least 6 characters.");

    header("Location: failed.php");

    exit();

  }

  if($region > 2){

    echo alertError("Invalid Region.");

    header("Location: failed.php");

    exit();

  }

Answer 1

挖了一点之后。答案是否定的，如果存储过程使用动态 SQL，那么它们就不安全。通过阅读手册几千遍，我能够利用准备好的陈述。