如何在使用MySQLi时防止SQL注入

I'm building a simple form and want to secure this against the following SQL-injections: - blind-injection - boolean-based - blind injection - UNION query-based - Stacked queries - error-based injections

I thought that I had it all secured, but when I run SQL-map it still exploits my database.

<?php

$input = $_GET['input'];

if ($input) {
    $db = mysqli_connect("localhost", "sec", "dubbelgeheim", "bookshop");

// Check connection
    if (mysqli_connect_errno()) {
        echo "Failed to connect to MySQL: " . mysqli_connect_error();
    }
    $escaper = real_escape_string($input);
    $statement = $db->prepare("SELECT * FROM productcomment WHERE ProductId = ? LIMIT 1");
    $statement->bind_param("s", $escaper);
    $statement->execute();
    $result = $statement->get_result();
    $statement->close();
    $count = $result->num_rows;
    if ($count > 0) {
        while ($row = $result->fetch_assoc()) {
            echo "Product:" . $row['ProductId'] . "<br>";
            echo "Annotation:" . $row['Comment'] . "<br>";
            echo "TestOK!<br>";
        }
    } 
    else {
        echo 'No record!';
    }
    $result->free();
    $db->close();
}
?>

Did I forget something?

Can anyone help?

Thanks in advance!

Your problem is caused by you displaying mysqli_connect_error(). This is OK for testing but should NOT be used in production code. You also don't need $escaper = real_escape_string($input);.

Try this instead

/* check connection */
if (mysqli_connect_errno()) {
    file_put_contents('MySQLiErrors.txt',date('[Y-m-d H:i:s]'). mysqli_connect_error()."
", FILE_APPEND); 
    exit();
}else{
     $statement = $db->prepare("SELECT * FROM productcomment WHERE ProductId = ? LIMIT 1");
     $statement->bind_param("s", $input);


}