Ai
3 Star 3 Fork 0

Inventocode/Qdata

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
api.php 3.42 KB
一键复制 编辑 原始数据 按行查看 历史
CodeKpy 提交于 2023-01-27 15:52 +08:00 . [upd]修复sql注入的高危漏洞
<?php
header('Content-Type:application/json; charset=utf-8');
header('Access-Control-Allow-Origin:*');
header("Access-Control-Allow-Headers: Content-Type");
header("Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS");
header("content-type: text/json;charset:utf-8");
require("./config.php");
$con=mysqli_connect($servername,$username,$password,$dbname);
date_default_timezone_set('PRC');//修改时间时区
$result_people_key = mysqli_query($con,"SELECT * FROM qdata_table WHERE id='".$_REQUEST["table_id"]."'");
if($result_people_key->num_rows == 0){//不存在这个数据表
$return = array('info'=>"There is not the tabel_id in our sql.", 'code'=>401);
echo json_encode($return);
}else{
while($row_people_key = mysqli_fetch_array($result_people_key)){
if($_REQUEST["key"]=hash("sha256", date('i', time()).$_REQUEST["table_id"].$row_people_key["token"])){//hash值比对成功
if($_REQUEST["mode"] == "set"){//设置键的内容
$result_value = mysqli_query($con,"SELECT * FROM ".$_REQUEST["table_id"]." WHERE name='".$_REQUEST["name"]."'"); //查看是否存在这个键
if ($result_value->num_rows==0){//不存在这个键,使用insert
$sql = "INSERT INTO ".$_REQUEST["table_id"]." (name, value) VALUES ('".$_REQUEST["name"]."', '".base64_encode($_REQUEST["value"])."')";
mysqli_query($con, $sql);
}else{//存在这个键,使用updata
$sql = "UPDATE `".$_REQUEST["table_id"]."` SET `value` = '".base64_encode($_REQUEST["value"])."' WHERE `".$_REQUEST["table_id"]."`.`name` = '".$_REQUEST["name"]."'";
mysqli_query($con, $sql);
}
}elseif ($_REQUEST["mode"] == "read"){//获取值
$result_value = mysqli_query($con,"SELECT * FROM ".$_REQUEST["table_id"]." WHERE name='".$_REQUEST["name"]."'"); //查看是否存在这个键
if ($result_value->num_rows==0){//不存在这个键
$return = array('info'=>"There is not the key_value in our sql.", 'code'=>404);
echo json_encode($return);
}else{//存在这个键
while($row_people_value = mysqli_fetch_array($result_value)){
$return = array('info'=>base64_decode(str_replace(" ","+",$row_people_value["value"])), 'code'=>200);
echo json_encode($return);
}
}
}elseif ($_REQUEST["mode"] == "del"){
$result_value = mysqli_query($con,"SELECT * FROM ".$_REQUEST["table_id"]." WHERE name='".$_REQUEST["name"]."';"); //查看是否存在这个键
if ($result_value->num_rows==0){//不存在这个键
$return = array('info'=>"There is not the key_value in our sql.", 'code'=>403);
echo json_encode($return);
}else{//存在这个键
$sql = "DELETE FROM `".$_REQUEST["table_id"]."` WHERE `".$_REQUEST["table_id"]."`.`name` = \"".$_REQUEST["name"]."\"";
mysqli_query($con, $sql);
$return = array('info'=>'Success', 'code'=>200);
echo json_encode($return);
}
}
}else{
$return = array('info'=>"The key is wrong, please check your request.", 'code'=>402);
echo json_encode($return);
}
}
}
?>
Loading...
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/Inventocode/qdata.git
git@gitee.com:Inventocode/qdata.git
Inventocode
qdata
Qdata
master

搜索帮助