2.万能条件语句,同样通过字段限制防注入
$pdo=new PDO('mysql:host=localhost;dbname=scms', 'root' ); $_POST=array('title'=>23,'content'=>'km'); $keys= array_keys($_POST); /** * $filetarr数组用于规定只可以写入的字段 */ $filetarr=array('title','content'); $filtre=true; $where=''; /** *$wherearr数组用来根据字段指定查询条件,例如大于,等于,like */ $wherearr=array('title'=>'like','content'=>'>%'); foreach ($keys as $value){ if(in_array($value, $filetarr,true)){ if($wherearr[$value]==='between'){ if(count(explode(',', $_POST[$value]))===1){ break; } $where.='and '.$value.' between '.":{$value}left".' and '.":{$value}right "; $_POST[$value]=explode(',', $_POST[$value]); $_POST[$value.'left']=$_POST[$value][0]; $_POST[$value.'right']=$_POST[$value][1]; unset($_POST[$value]); }else{ $where.='and '.$value.' '.$wherearr[$value].' '.":{$value} "; } }else{ //var_dump($value); $filtre=false; break; } } /** * *如果用or连接条件语句,截取前面两个字符 */ $where=substr($where,3); if($filtre){ $fields=implode(',', $keys); $fieldszwh=':'.implode(',:', $keys); $sql="select * from article where {$where}"; var_dump($sql); $pdostatement= $pdo->prepare($sql); $pdostatement->execute($_POST); $re= $pdostatement->fetchAll(); var_dump($pdostatement->errorInfo()); var_dump($_POST); var_dump($re); }else{ echo '非法字段'; } |
