改进聚合查询的安全性

2026-07-07 15:12:48 +08:00 · 2018-10-18 18:37:53 +08:00
parent 898fe001c2
commit 8652c83ea1
4 changed files with 39 additions and 5 deletions
--- a/library/think/db/builder/Mysql.php
+++ b/library/think/db/builder/Mysql.php
@@ -109,6 +109,9 @@ class Mysql extends Builder
            }
        }

+        if ($strict && !preg_match('/^[\w\.\*]+$/', $key)) {
+            throw new Exception('not support data:' . $key);
+        }
        if ('*' != $key && ($strict || !preg_match('/[,\'\"\*\(\)`.\s]/', $key))) {
            $key = '`' . $key . '`';
        }