警告：取消链接（/web/htdocs/www.vhannibal.net/home/setting/）：是 [...]

发布于 2024-10-27 01:01:34 字数 634 浏览 4 评论 0原文

require("$_SERVER[DOCUMENT_ROOT]mysql.php");
$id = $_GET["id"];
$result = mysql_query("SELECT * FROM Setting WHERE ID = \"$id\"");
$row = mysql_fetch_array($result);
switch ($_GET["action"])
{
    case "update":
    if (!unlink("$_SERVER[DOCUMENT_ROOT]setting/$row[Filename]"))
    {
        echo "Non è stato possibile cancellare il vecchio file.";
        header("Refresh: 2.5; url=index.php");
        exit();
    }

错误是“警告：取消链接（/web/htdocs/www.vhannibal.net/home/setting/）：第43行是[...]中的目录”，第43行是

if (!unlink("$_SERVER[DOCUMENT_ROOT]setting/$row[Filename]"))

有什么问题吗？

原文

require("$_SERVER[DOCUMENT_ROOT]mysql.php");
$id = $_GET["id"];
$result = mysql_query("SELECT * FROM Setting WHERE ID = \"$id\"");
$row = mysql_fetch_array($result);
switch ($_GET["action"])
{
    case "update":
    if (!unlink("$_SERVER[DOCUMENT_ROOT]setting/$row[Filename]"))
    {
        echo "Non è stato possibile cancellare il vecchio file.";
        header("Refresh: 2.5; url=index.php");
        exit();
    }

The error is "Warning: unlink(/web/htdocs/www.vhannibal.net/home/setting/): Is a directory in [...] on line 43", line 43 is

if (!unlink("$_SERVER[DOCUMENT_ROOT]setting/$row[Filename]"))

What's wrong with it?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

万劫不复 2024-11-03 01:01:34

首先，您应该考虑回到基础知识并阅读输入验证。

忽略明显的 mysql 注入问题，unlink() 只能在文件上调用。在此处的代码中，在删除 $row['Filename'] 之前，您不会检查它是否是一个文件。

您至少可以检查该文件是否存在

if (is_file("$_SERVER[DOCUMENT_ROOT]setting/{$row['Filename']}")) {
  //delete code
}

First off, you should consider going back to basics and reading up on input validation.

Ignoring the glaring mysql injection issue, unlink() can only be called on files. In your code here, you don't check whether $row['Filename'] is a file or not before deleting it.

The least you could do is check whether the file exists

if (is_file("$_SERVER[DOCUMENT_ROOT]setting/{$row['Filename']}")) {
  //delete code
}

回复收藏 0 原文

等待我真够勒 2024-11-03 01:01:34

$row[Filename] 中没有任何数据或其空字符串。

回复收藏 0 原文

江心雾 2024-11-03 01:01:34

由于还没有正确答案，我必须自己写。

正如 Gaurav 指出的那样，您没有检查 mysql 查询是否返回任何数据
因此，您的代码应该是（但是，我会以更常用的方式编写字符串）：

require($_SERVER['DOCUMENT_ROOT']."/mysql.php");
$sql = "SELECT * FROM Setting WHERE ID = ".intval($_GET["id"]);
$res = mysql_query() or trigger_error(mysql_error().$sql);
$row = mysql_fetch_array($result);

if ($row) // <-- here it is!
{
    switch ($_GET["action"])
    {
        case "update":
        if (!unlink($_SERVER['DOCUMENT_ROOT']."setting/".$row['Filename']))
        {
            echo "Non è stato possibile cancellare il vecchio file.";
            header("Refresh: 2.5; url=index.php");
            exit();
        }
    }
}

As there is still no right answer I have to write it myself.

As Gaurav pointed it out, you are not checking if mysql query returned any data
thus, your code should be (however, I'd write strings more usual way):

require($_SERVER['DOCUMENT_ROOT']."/mysql.php");
$sql = "SELECT * FROM Setting WHERE ID = ".intval($_GET["id"]);
$res = mysql_query() or trigger_error(mysql_error().$sql);
$row = mysql_fetch_array($result);

if ($row) // <-- here it is!
{
    switch ($_GET["action"])
    {
        case "update":
        if (!unlink($_SERVER['DOCUMENT_ROOT']."setting/".$row['Filename']))
        {
            echo "Non è stato possibile cancellare il vecchio file.";
            header("Refresh: 2.5; url=index.php");
            exit();
        }
    }
}

回复收藏 0 原文

~没有更多了~