SQL注入漏洞，帶有使用串聯的准備好的語句

Question

以這種方式使用串聯的參數化代碼是否會有SQL注入漏洞？ 我認為可以，但是我不確定什么POST數據可以利用它。

        foreach ($_POST as $key => $value) {
          $columns .= ($columns == "") ? "" : ", ";
          $columns .= $key;
          $holders .= ($holders == "") ? "" : ", ";
          $holders .= ":".$value;
        }

        $sql = "INSERT INTO request ($columns) VALUES ($holders)";

        $stmt = $this->pdo->prepare($sql);

        foreach($_POST as $key => $value) {
          $field = ":".$key;
          $stmt->bindValue($field, $value);
        }

        $stmt->execute();

Answer 1

您需要一個數組來存儲請求表的所有列，並檢查數組中是否存在發布鍵。

PHP代碼：

$request_columns = array('column1','column2');// all the columns of request table

foreach ($_POST as $key => $value) {
    if(in_array($key,$request_columns)){
          $columns .= ($columns == "") ? "" : ", ";
          $columns .= $key;
          $holders .= ($holders == "") ? "" : ", ";
          $holders .= ":".$key;
     }
}

$sql = "INSERT INTO request ($columns) VALUES ($holders)";

$stmt = $this->pdo->prepare($sql);

foreach($_POST as $key => $value) {
  if(in_array($key,$request_columns)){
      $field = ":".$key;
      $stmt->bindValue($field, $value);
   }
}

$stmt->execute();

Answer 2

@KetanYekale是正確的，您需要過濾$ _POST以獲取已知的列名。

這是使用一些PHP內置函數的另一種實現方法。

$request_columns = array('column1','column2');// all the columns of request table

# get a subset of $_POST, only those that have keys matching the known request columns
$post_only_columns = array_intersect_key(
  $_POST,
  array_flip($request_column)
);

# make sure columns are delimited like `name` in case they are SQL reserved words
$columns = implode(array_map(function ($col) { return "`$col`"; }, array_keys($post_only_columns), ', ';

# use ? positional holders, not named holders. it's easier in this case
$holders = implode(array_fill(1, count($post_only_columns), '?'), ', ');

$sql = "INSERT INTO request ($columns) VALUES ($holders)";

$stmt => $this->pdo->prepare($sql);

# no need to bindValue() or use a loop, just pass the values to execute()
$stmt->execute( array_values($post_only_columns) );

PHP具有許多Array函數 ，可以在不同情況下使用它們，以使您的代碼更快，更簡潔。 您可以使用這些函數來避免編寫某些類型的foreach循環代碼。