我正在嘗試在我的網(wǎng)站上創(chuàng)建動態(tài)搜索功能，用戶可以選擇根據(jù) ID、品牌、型號或日期查找索賠信息。有一個搜索欄可用于輸入數(shù)據(jù)，單選按鈕提供搜索過濾器。我想知道我的簡單 if 語句方法是否存在 SQL 注入漏洞，因為我直接將變量作為列名傳遞（據(jù)我所知，PDO 不會讓您將此值作為參數(shù)傳遞）HTML 代碼： <form method="POST" action="find-claims.php"> <label for="find-claim">Find Claim:</label> <input type="search" id="claim-search-bar" name="claim-search-bar"><br/> <input type="radio" value="by-id" class="radio-param" name="search-param" checked><label for="by-id">By Claim Id</label> <input type="radio" value="by-make" class="radio-param" name="search-param"><label for="by-make">By Vehicle Make</label> <input type="radio" value="by-model" class="radio-param" name="search-param"><label for="by-model">By Vehicle Model</label> <input type="radio" value="by-date" class="radio-param" name="search-param"><label for="by-date">By Claim Date</label> <input type="submit" class="radio-param" value="Submit"> </form>PHP代碼：// Get search data$searchVal = $_POST["claim-search-bar"];// Get radio value$searchType = $_POST["search-param"];// Store search type into db-naming scheme$radioVal = "";if($searchType == "by-id"){ $radioVal = "claim_id";}else if($searchType == "by-make"){ $radioVal = "make";}else if($searchType == "by-model"){ $radioVal = "model";}else if($searchType == "by-date"){ $radioVal = "date_received";}// DB Interactiontry{ // Connection to DB require "../db-info.php"; $dbh = new PDO("mysql:host=$serverName; dbname=$dbName", $userName, $password); $dbh->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION ); // Get Claim based off dynamic input $getClaim = $dbh->prepare("SELECT * FROM claims WHERE $radioVal = ?"); $getClaim->bindParam(1, $searchVal); $getClaim->execute(); $claimInfo = $getClaim->fetchAll(); // Checks if DB returned any data if($claimInfo){ // Display corresponding info }
2 回答
慕桂英3389331
TA貢獻2036條經(jīng)驗 獲得超8個贊
您可以將搜索值存儲在數(shù)組中。除了刪除無用的 try-catch 之外，它還會使您的代碼不再那么臃腫。
// Get search data
$searchVal = $_POST["claim-search-bar"];
// Get radio value
$searchType = $_POST["search-param"];
// Store search type into db-naming scheme
$searchValues = [
"by-id" => "claim_id",
"by-make" => "make",
"by-model" => "model",
"by-date") => "date_received",
];
$radioVal = $searchValues[$searchType] ?? "claim_id";
// Connection to DB
require "../db-info.php";
// the connection code should really go into include
// Get Claim based off dynamic input
$getClaim = $dbh->prepare("SELECT * FROM claims WHERE $radioVal = ?");
$getClaim->execute([$searchVal]);
$claimInfo = $getClaim->fetchAll();
// Checks if DB returned any data
if($claimInfo){
// Display corresponding info
}
else{
echo "sorry no claim found";
}
心有法竹
TA貢獻1866條經(jīng)驗 獲得超5個贊
因為$radioVal只分配了您在代碼中編寫的文字值，并且從未分配任何不受信任的內(nèi)容，所以對于 SQL 注入來說它是安全的。
但是，我建議您為其指定一個比"". 因為如果 的已知值都不$searchType匹配，則 then$radioVal將保留""，您將得到以下 SQL 語句：
SELECT * FROM claims WHERE = ?
這將是一個語法錯誤。這不會是由于 SQL 注入造成的，但它不會起作用。
順便說一下，你不需要消毒$searchVal。這就是使用綁定參數(shù)的要點，它是在查詢準備好之后綁定的，因此它不會引入 SQL 注入。消毒與否并不重要。
- 2 回答
- 0 關(guān)注
- 146 瀏覽
添加回答
舉報
0/150
提交
取消