SQL防注入

  //start SQL防注入 ----------------改漏洞
        var getParams = ctx.query;
        var postParams = ctx.request.body;
        var pattern = new RegExp("[~#$^{}\]");
        var pattern1 = new RegExp("[`~@#$^*|{}:;\\[\\]<>/……——|]");
        var numRe = /^[0-9]+.?[0-9]*$/;
        var re = /select|update|delete|truncate|join|union|exec|insert|drop|count/i;
        console.log(getParams, 'getParams')
        console.log(postParams, 'postParams1')
        var jsonGetParams = filterValue(getParams)
        var jsonPostParams = filterValue(postParams)
        console.log(jsonGetParams, 'postParams2')
        console.log(ctx.request.url, '地址==========')

        if (jsonGetParams.pageNum) {
            if (!numRe.test(jsonGetParams.pageNum) || !numRe.test(jsonGetParams.pageSize)) {
                ctx.response.status = 500;
            }
        }
        if (jsonPostParams.pageNum) {
            if (!numRe.test(jsonPostParams.pageNum) || !numRe.test(jsonPostParams.pageSize)) {
                ctx.response.status = 500;
            }
        }
        if (ctx.request.url.indexOf('access_token')) {

        } else {


            for (let i = 0; i < jsonGetParams.length; i++) {

                if (re.test(jsonGetParams[i]) || pattern1.test(jsonGetParams[i])) {

                    ctx.response.status = 500;


                    // ctx.body = '<h1>非法参数提交，请重新输入</h1>';

                    // console.log(ctx.response, 'ctx.response');

                    // return false;
                } else { }

            }
        }
        for (let i = 0; i < jsonPostParams.length; i++) {

            if (re.test(jsonPostParams[i]) || pattern.test(jsonPostParams[i])) {
                console.log(ctx.request.url, '地址')
                if (ctx.request.url.indexOf('/inserttsj') > -1 || ctx.request.url.indexOf('/inserttsjupdate') > -1 || ctx.request.url.indexOf('/yjfkData') > -1
                ) {
                    //过滤登录，意见反馈，提问，修改提问，评价专家接口
                } else {
                    ctx.response.status = 500;

                    // return false;
                }
            }
        }