是否使用WordPress的get_results（）數據庫函數防止sql注入

Question

似乎無法找到答案，但想知道對數據庫的以下查詢是否容易受到sql注入的影響。

$searchPostResults = $wpdb->get_results($querySearchVals, OBJECT); 

這是用來查詢：

global $wpdb; 
$offset = (isset($_POST["moreSearchResults"])) ? $_POST["searchOffset"] : 0; 

$querySearchVals = " 
    SELECT DISTINCT post_title, ID 
    FROM {$wpdb->prefix}posts 
    WHERE ("; 

$sVals = array(); 
$sVals = explode(" ", $searchVal); 

$lastIndex = intval(count($sVals)) - 1; 
$orderByCaseVals = ""; 
for($i = 0; $i<count($sVals);$i++) 
{ 
    $querySearchVals .= " post_title LIKE '%$sVals[$i]%' "; 
    if($i != $lastIndex) 
     $querySearchVals .= " OR "; 

    $orderByCaseVals .= " WHEN post_title LIKE '%$sVals[$i]%' THEN ($i + 2) "; 
} 

$querySearchVals .= ") 
    AND {$wpdb->prefix}posts.post_type = 'post' 
    AND post_status = 'publish' 
    ORDER BY CASE 
     WHEN post_title LIKE '%$searchVal%' THEN 1 
     $orderByCaseVals 
    END 
    LIMIT $offset, 6; 
"; 

乾杯

Answer 1

好了，所以作爲tadman解釋get_results不會阻止SQL注入攻擊。

需要使用準備功能。

我已經重新編寫上面的代碼，以防止SQL注入：

global $wpdb; 
$offset = (isset($_POST["moreSearchResults"])) ? $_POST["searchOffset"] : 0; 

$querySearchVals = " 
    SELECT DISTINCT post_title, ID 
    FROM {$wpdb->prefix}posts 
    WHERE ("; 

$sVals = array(); 
$sVals = explode(" ", $searchVal); 

$lastIndex = intval(count($sVals)) - 1; 
$orderByCaseVals = ""; 
for($i = 0; $i<count($sVals);$i++) 
{ 
    $queryPrep = $wpdb->prepare(" post_title LIKE '%%%s%%' ", $wpdb->esc_like($sVals[$i])); 
    $querySearchVals .= $queryPrep; 
    if($i != $lastIndex) 
     $querySearchVals .= " OR "; 

    $queryPrep = $wpdb->prepare(" WHEN post_title LIKE '%%%s%%' THEN ($i + 2) ", $wpdb->esc_like($sVals[$i])); 
    $orderByCaseVals .= $queryPrep; 
} 

$querySearchVals .= ") 
    AND {$wpdb->prefix}posts.post_type = 'post' 
    AND post_status = 'publish' 
    ORDER BY CASE"; 

$queryPrep = $wpdb->prepare(" WHEN post_title LIKE '%%%s%%' THEN 1 ", $wpdb->esc_like($searchVal)); 
$querySearchVals .= $queryPrep; 
$querySearchVals .= " 
     $orderByCaseVals 
    END 
"; 

$queryPrep = $wpdb->prepare(" LIMIT %d, 12", $offset); 
$querySearchVals .= $queryPrep . ";";