我总是喜欢使用其他清理方法（和准备好的语句），但在某些情况下，客户不希望我更改他的原始脚本中的一行（我只会添加一个插件）
我担心有人可以利用通过修改 $POST 值，他可能会责怪我（就像客户通常所做的那样）：
extract($_POST, EXTR_PREFIX_ALL, "POST");
$q = sprintf(ARQ, trim($POST_string));
$res = doexec($q);
DEFINE("ARQ", "INSERT INTO library (string) VALUES ('%s')");
我尝试了几种组合，但我所能得到的只是一个错误，没有 mysql 注入
那么，这足够安全吗？
i always like to use other sanitazing methods (and prepared statments) but i am under certain conditions where the client doesn`t want me to change a single line from his original script (im only going to add a plugin)
im worried someone could exploit this by modifying the $POST values and he could blame me (like clients usually do):
extract($_POST, EXTR_PREFIX_ALL, "POST");
$q = sprintf(ARQ, trim($POST_string));
$res = doexec($q);
DEFINE("ARQ", "INSERT INTO library (string) VALUES ('%s')");
i tried several combinations but all i could get was an error, no mysql inject
so, is this secure enough, as is?
发布评论
评论（1）
我想
doexec调用的东西不接受与;链接的多个命令？您仍然可以使用子查询从其他表插入密码和其他敏感数据（假设用户可以读回他保存的数据 - 否则您可以使用 定时攻击）。如果文件系统的安全性与数据库访问代码的安全性一样差，则可以使用 SELECT INTO 创建可以执行的 php 脚本。I suppose
doexeccalls something that does not accept multiple commands chained with;? You could still use a subquery to insert passwords and other sensitive data from other tables (assuming the user can read back the data he saved - otherwise you can use a timing attack). If the filesystem security is as poor as that of the database access code, you can use SELECT INTO to create a php script you can execute.