我正在尝试在我的网站上创建动态搜索功能，用户可以选择根据 ID、品牌、型号或日期查找索赔信息。有一个搜索栏可用于输入数据，单选按钮提供搜索过滤器。我想知道我的简单 if 语句方法是否存在 SQL 注入漏洞，因为我直接将变量作为列名传递（据我所知，PDO 不会让您将此值作为参数传递）HTML 代码： <form method="POST" action="find-claims.php"> <label for="find-claim">Find Claim:</label> <input type="search" id="claim-search-bar" name="claim-search-bar"><br/> <input type="radio" value="by-id" class="radio-param" name="search-param" checked><label for="by-id">By Claim Id</label> <input type="radio" value="by-make" class="radio-param" name="search-param"><label for="by-make">By Vehicle Make</label> <input type="radio" value="by-model" class="radio-param" name="search-param"><label for="by-model">By Vehicle Model</label> <input type="radio" value="by-date" class="radio-param" name="search-param"><label for="by-date">By Claim Date</label> <input type="submit" class="radio-param" value="Submit"> </form>PHP代码：// Get search data$searchVal = $_POST["claim-search-bar"];// Get radio value$searchType = $_POST["search-param"];// Store search type into db-naming scheme$radioVal = "";if($searchType == "by-id"){ $radioVal = "claim_id";}else if($searchType == "by-make"){ $radioVal = "make";}else if($searchType == "by-model"){ $radioVal = "model";}else if($searchType == "by-date"){ $radioVal = "date_received";}// DB Interactiontry{ // Connection to DB require "../db-info.php"; $dbh = new PDO("mysql:host=$serverName; dbname=$dbName", $userName, $password); $dbh->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION ); // Get Claim based off dynamic input $getClaim = $dbh->prepare("SELECT * FROM claims WHERE $radioVal = ?"); $getClaim->bindParam(1, $searchVal); $getClaim->execute(); $claimInfo = $getClaim->fetchAll(); // Checks if DB returned any data if($claimInfo){ // Display corresponding info }
2 回答
慕桂英3389331
TA贡献2036条经验 获得超8个赞
您可以将搜索值存储在数组中。除了删除无用的 try-catch 之外，它还会使您的代码不再那么臃肿。
// Get search data
$searchVal = $_POST["claim-search-bar"];
// Get radio value
$searchType = $_POST["search-param"];
// Store search type into db-naming scheme
$searchValues = [
"by-id" => "claim_id",
"by-make" => "make",
"by-model" => "model",
"by-date") => "date_received",
];
$radioVal = $searchValues[$searchType] ?? "claim_id";
// Connection to DB
require "../db-info.php";
// the connection code should really go into include
// Get Claim based off dynamic input
$getClaim = $dbh->prepare("SELECT * FROM claims WHERE $radioVal = ?");
$getClaim->execute([$searchVal]);
$claimInfo = $getClaim->fetchAll();
// Checks if DB returned any data
if($claimInfo){
// Display corresponding info
}
else{
echo "sorry no claim found";
}
心有法竹
TA贡献1866条经验 获得超5个赞
因为$radioVal只分配了您在代码中编写的文字值，并且从未分配任何不受信任的内容，所以对于 SQL 注入来说它是安全的。
但是，我建议您为其指定一个比"". 因为如果 的已知值都不$searchType匹配，则 then$radioVal将保留""，您将得到以下 SQL 语句：
SELECT * FROM claims WHERE = ?
这将是一个语法错误。这不会是由于 SQL 注入造成的，但它不会起作用。
顺便说一下，你不需要消毒$searchVal。这就是使用绑定参数的要点，它是在查询准备好之后绑定的，因此它不会引入 SQL 注入。消毒与否并不重要。
- 2 回答
- 0 关注
- 73 浏览
添加回答
举报
0/150
提交
取消