English
English
In PHP development, preventing SQL injection attacks is a crucial security practice. Using prepared statements and binding parameters is one of the most recommended ways at present. Among them, although the mysqli_stmt::attr_get function is not as direct as binding parameters in use, it also has positive significance for improving developers' security awareness and skills in the process of understanding its role and principles. This article will introduce the role of mysqli_stmt::attr_get and explain its auxiliary role in preventing SQL injection.
mysqli_stmt::attr_get is a function used to obtain the attribute value of the current statement object. Its main purpose is to check or get the values of some internal properties when using the mysqli_stmt object for further processing or debugging.
The syntax is as follows:
public mysqli_stmt::attr_get(int $attribute): int|false
where $attribute is the attribute you want to get, such as MYSQLI_STMT_ATTR_UPDATE_MAX_LENGTH , and the return value is the current value of the attribute, or it returns false on failure.
Although mysqli_stmt::attr_get itself does not directly prevent SQL injection, it is more like a debugging tool, but in the process of using preprocessing statements, it can help developers verify the safe state of the statement execution, or use it to confirm that the parameter binding is effective as expected. More importantly, it makes developers gradually accustomed to operating through mysqli_stmt object, away from the high-risk writing method of directly splicing SQL.
Below we use an example of using preprocessing statements to illustrate how to prevent SQL injection through a regular method and demonstrate how to use attr_get for attribute checking.
Suppose we have a user login system and the front-end submits the username, we need to query the records in the database based on that username.
$username = $_GET['username'];
$sql = "SELECT * FROM users WHERE username = '$username'";
$result = $mysqli->query($sql);
If the username entered by the user is admin' -- , the above SQL will be spliced as:
SELECT * FROM users WHERE username = 'admin' --'
This skips password verification, causing serious security vulnerabilities.
$mysqli = new mysqli("localhost", "user", "password", "database");
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $_GET['username']);
$stmt->execute();
$result = $stmt->get_result();
// Optional：Check a property value
$attr = $stmt->attr_get(MYSQLI_STMT_ATTR_UPDATE_MAX_LENGTH);
if ($attr !== false) {
// Output attribute value，Used to debug or verify statement behavior
echo "Current statement attributes：$attr";
}
In the above code:
prepare() creates a precompiled SQL template.
bind_param() binds user input as parameters and will not be parsed as SQL code.
attr_get() can be used to obtain statement attributes, which can help developers judge the current behavior status of the statement object in some scenarios.
Suppose we want to get the username parameters from a page where the form is submitted https://m66.net/login.php and query the user information:
<form action="https://m66.net/login.php" method="get">
<input type="text" name="username" />
<input type="submit" value="Log in" />
</form>
Server-side processing code:
$mysqli = new mysqli("localhost", "user", "password", "database");
$stmt = $mysqli->prepare("SELECT id, email FROM users WHERE username = ?");
$stmt->bind_param("s", $_GET['username']);
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
echo "userID：" . $row['id'] . "<br>";
echo "Mail：" . $row['email'] . "<br>";
}
// use attr_get Check properties
$attr = $stmt->attr_get(MYSQLI_STMT_ATTR_UPDATE_MAX_LENGTH);
if ($attr !== false) {
error_log("stmt property：$attr", 0);
}
Although mysqli_stmt::attr_get is not a function that prevents SQL injection directly, it is a powerful tool to understand the state of statement objects in the context of parameterized queries using the mysqli_stmt interface. Combined with prepare() and bind_param() , it not only helps build secure queries, but also enhances the debuggability and robustness of the code. Developers should always give priority to using parameterized queries and use tool functions such as attr_get to further enhance the transparency and security control of the code.
