WordPress的默認搜索，如何處理SQL注入

Question

WordPress的默認SQL搜索，如何處理SQL Injection在默認搜索期間。

例如：Sitename.com/?q=test OR 1 = 1 -

即

Q =測試％20or％201 = 1％20--

顯示所有文章。

Answer 1

對於您可以使用三種掛鉤，

• 「posts_join」鉤子加入自定義表後表
• 「posts_where」鉤擴大在查詢的WHERE子句中 您的自定義外觀表字段。

• 「posts_groupby」鉤BY子句將組添加到查詢

  add_filter('posts_join', 'prefix_search_join'); 
  add_filter('posts_where', 'prefix_search_where'); 
  add_filter ('posts_groupby', 'prefix_search_groupby'); 
  
  function prefix_search_join($join) 
  { 
      //global $custom_table contain your custom table name 
      global $custom_table, $wpdb; 
  
      if(is_search()) { 
      //your joining sql 
      } 
      return $join; 
  } 
  
  function prefix_search_where($where) 
  { 
      if(is_search()) { 
      //Where clause 
      } 
      return $where; 
  } 
  
  function prefix_search_groupby($groupby) 
  { 
      global $wpdb; 
  
      if(!is_search()) { 
      return $groupby; 
      } 
  
      //we need to group on post ID 
      $mygroupby = "{$wpdb->posts}.ID"; 
  
      if(preg_match("/$mygroupby/", $groupby)) { 
      //grouping we need is already there 
      return $groupby; 
      } 
      if(!strlen(trim($groupby))) { 
      //groupby was empty, use ours 
      return $mygroupby; 
      } 
      //wasn't empty, append ours 
      return $groupby . ", " . $mygroupby; 
  } 
  

更多細節，檢查此鏈接https://codex.wordpress.org/Custom_Queries我希望它會幫助你