Skip to content

Commit 65ea22b

Browse files
zzfly256zzfly256
committed
修复 PUT/DELETE 等方法读取错误，修复 where() 方法拼接时存在的安全隐患，新增 cli 启动方式
1 parent 04504fa commit 65ea22b

File tree

6 files changed

+49
-45
lines changed

6 files changed

+49
-45
lines changed

‎App/Controller/apiController.php‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,8 @@
77

88
class apiController extends Controller {
99

10-
public function testGet(){
11-
$demo = new Demo();
12-
$demo->abc = 1;
13-
$demo->acb = 1;
14-
15-
return $this->response($demo);
10+
public function testDelete(){
11+
return $this->response($this->request->get('name'));
1612
}
1713

1814
// ORM 查询类方法演示

‎System/Database.php‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,8 @@ public function setModel($modelClass) {
8686

8787
/**
8888
* SQL 语句预处理并执行
89-
* @param string $sqlStatement, array $parameters
89+
* @param string $sqlStatement
90+
* @param array $parameters
9091
* @return boolean
9192
* @uses 用于预处理并执行语句，请注意本方法结合了 pdo 中 prepare 和 execute 两个方法
9293
*/
@@ -194,9 +195,9 @@ public function where($sqlConditionArray = []){
194195
// 传入条件，进行 SQL 语句拼接
195196
foreach ($sqlConditionArray as $key => $value) {
196197
if (isset($whereSQL)) {
197-
$whereSQL .= " AND ".$key.'="'.$value.'"';
198+
$whereSQL .= " AND ".$key.'="'.addslashes($value).'"';
198199
} else {
199-
$whereSQL = $key.'="'.$value.'"';
200+
$whereSQL = $key.'="'.addslashes($value).'"';
200201
}
201202
}
202203
$this->where = '('.$whereSQL.')';
@@ -212,9 +213,9 @@ public function where($sqlConditionArray = []){
212213
// 传入条件，进行 SQL 语句拼接
213214
foreach ($sqlConditionArray as $key => $value) {
214215
if (isset($whereSQL)) {
215-
$whereSQL .= " AND ".$key.'="'.$value.'"';
216+
$whereSQL .= " AND ".$key.'="'.addslashes($value).'"';
216217
} else {
217-
$whereSQL = $key.'="'.$value.'"';
218+
$whereSQL = $key.'="'.addslashes($value).'"';
218219
}
219220
}
220221
$this->where .= ' AND ('.$whereSQL.')';
@@ -274,9 +275,9 @@ public function orWhere($sqlConditionArray = []){
274275
// 传入条件，进行 SQL 语句拼接
275276
foreach ($sqlConditionArray as $key => $value) {
276277
if (isset($whereSQL)) {
277-
$whereSQL .= " AND ".$key.'="'.$value.'"';
278+
$whereSQL .= " AND ".$key.'="'.addslashes($value).'"';
278279
} else {
279-
$whereSQL = $key.'="'.$value.'"';
280+
$whereSQL = $key.'="'.addslashes($value).'"';
280281
}
281282
}
282283
$this->where .= ' OR ('.$whereSQL.')';
@@ -306,7 +307,8 @@ public function orWhereRaw($sqlConditionStatement = ''){
306307

307308
/**
308309
* join 语句
309-
* @param string $table, string $method = inner
310+
* @param string $table, string
311+
* @param$method = inner
310312
* @return Database
311313
* @uses 用于根据两个或多个表中的列之间的关系查询数据。其中 method 可选 left, right, full, inner
312314
*/
@@ -340,7 +342,8 @@ public function on($sqlConditionStatement){
340342

341343
/**
342344
* 根据字段排列结果集
343-
* @param string|array $field, string $method
345+
* @param string|array $field
346+
* @param string $method
344347
* @return Database
345348
* @uses 根据字段排列结果集, 其中 $field 可为单个字段字符串或关联数组
346349
*/
@@ -422,9 +425,15 @@ public function delete(){
422425
return $this->prepare($this->SQLStatement);
423426
}
424427

428+
public function count(){
429+
$countSQL = str_replace($select, 'COUNT('.$select.')', $this->SQLStatement);
430+
return $this->PDOConnect->query($countSQL)->fetch()[0];
431+
}
432+
425433
/**
426434
* Database 分页
427-
* @param int $pageNum, boolean $furtherPageInfo
435+
* @param int $pageNum
436+
* @param boolean $furtherPageInfo
428437
* @return Collection
429438
* @uses 数据库 LIMIT 语句调用
430439
*/

‎System/Http/Request.php‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@
1010
protected $method;
1111
protected $url;
1212
protected $path;
13-
protected $postArray;
14-
protected $getArray;
13+
protected $requestArray;
1514

1615

1716
/**
@@ -22,8 +21,12 @@ public function __construct(){
2221
$this->method = strtolower($_SERVER['REQUEST_METHOD']);
2322
$this->path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
2423
$this->url = $_SERVER["REQUEST_URI"];
25-
$this->postArray = $_POST;
26-
$this->getArray = $_GET;
24+
$this->requestArray = $_REQUEST;
25+
if(!in_array($this->method,['post','get'])){
26+
parse_str(file_get_contents('php://input'), $_OTHER);
27+
$this->requestArray = array_merge($this->requestArray,$_OTHER);
28+
}
29+
2730
}
2831

2932

@@ -32,7 +35,7 @@ public function __construct(){
3235
* @return array
3336
*/
3437
public function all(){
35-
return array_merge($this->postArray, $this->getArray);
38+
return $this->requestArray;
3639
}
3740

3841
/**
@@ -49,12 +52,8 @@ public function get($field){
4952
$resultArray[] = $this->get($value);
5053
return $resultArray;
5154
}
52-
} else if(array_key_exists($field,$this->postArray)) {
53-
// POST 取值
54-
return $this->postArray[$field];
55-
} elseif(array_key_exists($field,$this->getArray)) {
56-
// GET 取值
57-
return $this->getArray[$field];
55+
} else if(array_key_exists($field,$this->requestArray)) {
56+
return $this->requestArray[$field];
5857
} else {
5958
// 键值不存在
6059
return null;

‎System/Model.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ class Model implements Jsonable
3030
*/
3131
public static function find($id){
3232
$db = new Database(static::$table);
33-
if($result = $db->where([ 'id' => $id])->fetch()){
33+
if($result = $db->where([ 'id' => intval($id)])->fetch()){
3434
return new static($result);
3535
} else {
3636
return null;

‎System/Utility/Functions.php‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,36 +8,29 @@
88
// 调试封装
99
if(!function_exists('dump')){
1010
/**
11-
* @param $toDo
11+
* @param $param
1212
* @uses 打印变量
1313
*/
14-
function dump($toDo){
14+
function dump($param){
1515
echo "<pre>";
16-
if (is_array($toDo)) {
17-
print_r($toDo);
18-
} elseif (is_object($toDo)) {
19-
print_r($toDo);
16+
if (is_array($param)) {
17+
print_r($param);
18+
} elseif (is_object($param)) {
19+
print_r($param);
2020
} else {
21-
var_dump($toDo);
21+
var_dump($param);
2222
}
2323
}
2424
}
2525

2626
if(!function_exists('dd')){
2727
/**
28-
* @param $toDo
28+
* @param $param
2929
* @uses 打印变量并停止运行
3030
*/
31-
function dd($toDo){
31+
function dd($param){
3232
echo "<pre>";
33-
if (is_array($toDo)) {
34-
print_r($toDo);
35-
} elseif (is_object($toDo)) {
36-
37-
print_r($toDo);
38-
} else {
39-
var_dump($toDo);
40-
}
33+
dump($param);
4134
die();
4235
}
4336
}

‎index.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
<?php
2+
if (php_sapi_name() == "cli"){
3+
echo "Welcome to PHP QuickORM Framework ..\n";
4+
echo "Starting development server at Port: 8000\n";
5+
exec("php -S 0.0.0.0:8000");
6+
die();
7+
}
8+
29
require __DIR__.'/vendor/autoload.php';
310
use \System\Http\Route;
411
use \System\Http\Request;

0 commit comments

Comments
 (0)