mirror-fastadminnet/framework
1
0
Fork 0
mirror of https://gitee.com/fastadminnet/framework.git synced 2026-07-07 15:12:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

改进聚合查询的安全性

Browse Source
This commit is contained in:
thinkphp
2018-10-18 18:37:53 +08:00
parent 898fe001c2
commit 8652c83ea1
4 changed files with 39 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
library/think/db/builder/Mysql.php
View File

@@ -109,6 +109,9 @@ class Mysql extends Builder
}
}
if ($strict && !preg_match('/^[\w\.\*]+$/', $key)) {
throw new Exception('not support data:' . $key);
}
if ('*' != $key && ($strict || !preg_match('/[,\'\"\*\(\)`.\s]/', $key))) {
$key = '`' . $key . '`';
}

4
library/think/db/builder/Sqlsrv.php
View File

@@ -94,6 +94,10 @@ class Sqlsrv extends Builder
$table = $options['alias'][$table];
}
}
if ($strict && !preg_match('/^[\w\.\*]+$/', $key)) {
throw new Exception('not support data:' . $key);
}
if ('*' != $key && ($strict || !preg_match('/[,\'\"\*\(\)\[.\s]/', $key))) {
$key = '[' . $key . ']';
}