代码规范---不要信任任何参数.pptVIP

代码规范 不要信任任何参数 syntax to use near 'and flag in(0,1) ORDER BY `default` desc,id desc LIMIT 200 OFFSET 0' at line 1, TRACE: error_url : /community/viewphotos/237418/228857 refer : #0 () : apf_error_handler(256,SELECT * FROM loupan_images WHERE loupan_id=237418 and category= and flag in(0,1) ORDER BY `default`,/home/www/release/v2/2010_35_22/system/classes/apf/db/PDOStatement.php,28,Array ( [input_parametders] => Array ( ) [logger] => APF_Logger Object ( [priority:private] => 4 [pri) Aug 24 15:03:12 app10-018 APF[29768]: [3] [APF_DB_PDOStatement] [nhslave]->execute: SELECT * FROM loupan_list_custom_basic WHERE (`city_id` = ?) AND (`is_del` = ?) AND ( (title LIKE '%<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>%' OR key_words LIKE '%<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>%') AND ?) ORDER BY id DESC LIMIT 6 OFFSET 0 出现以上的问题，一定是自己定义了一些sql，没有 bind_param，也没有对输入的参数进行转义或者判断是否为空。 不要在controller中查询、共享数据 $data['daily_articles'] = Inform_AbstractController::find_daily_article_rank($city_id, 10); $data['view_freq_rank'] = Inform_AbstractController::find_view_freq_rank($city_id, 10); $view_freq_rank = Inform_AbstractController::find_view_freq_rank($city_id, 10); 看过很多代码，发现大家很喜欢在controller中处理一些数据，正常情况下，没有问题，但是当我们一些其他的应用，例如要在iphone上显示楼盘单页，其实很多数据和web是差不多的，但是如果写在controller中，iphone上就必须重新写一遍，并且写在controller中不容易测试 不要在controller中控制流程 public function handle_request() { echo $this->user_register($params); } private function user_register(array $params){ ....... if(empty($username)){ ....... } elseif(empty($phone)){ ....... } elseif(!Aifang_Core_Util_Validate::valid_phone($phone)){ ....... } if($is_valid){ ....... if($time > strtotime($tuan_info['date_end'])) { ....... } elseif($time < strtotime($tuan_info['date_start'])) { ....... } elseif($tuan_info['join_nu