PHP eval()在我的代码中可被利用吗? (动态参数) [英] PHP eval() is this exploitable in my code? (dynamic arguments)
问题描述
在阅读了其他用户的所有输入后,我决定使用@chris建议的内容 call_user_func_array()一个不使用的理由eval()的速度比 call_user_func_array()慢,但是到目前为止,没有人能够以我的方式利用它,如果您找到了一种方法,请将其发布为答案或评论:).这样每个人都可以从中学到东西. 祝大家圣诞快乐!
after reading all the input from the other users, i decided, to use what @chris suggested call_user_func_array() one more reason not to use eval() its slower than call_user_func_array(), but so far, nobody was able to exploit it my way, if you find a way, please post it as answer or comment :). So everybody can learn from it. Merry XMAS to all!
---编辑结束---
好,我需要制作一个动态代码:
Ok i needed to make a dynamic code:
我得到用户输入,例如 $ _ POST ['a'],$ _ POST ['b']; ////取决于每个查询有多少用户输入.
I get user input like $_POST['a'], $_POST['b']; // Depends on each query how many user input.
$sql = "SELECT 1, 2, 3 FROM x WHERE b = ? AND a = ? LIMIT 10"; // SQL STATEMENT
$input = array($_POST['a'], $_POST['b']);
$output = 3; // Number of variables need for 1, 2, 3
$data = readDB2($sql, $input, $output);
var_dump($data);
此输入将传递给mysqli->准备好的语句
this input, gets passed to mysqli->prepared statements
因为变量的数量是动态的($ input和$ output);
cause the number of variables is dynamic ($input and $output);
我使用了php函数eval();现在我的问题可以在我的代码中加以利用吗?
i used the php function eval(); Now my question can this be exploited, in my code?
只需查看我的函数readDB2即可了解我如何使用eval()函数(使用3次).
Just look in my function readDB2 to see how i used the eval() function (used it 3x times).
public function readDB2($sql, $input, $output1) {
$stmt = $this->mysqli->prepare($sql);
if(!empty($input) && is_array($input)) {
$sp = "";
$data = "";
$inputn = count($input) - 1;
for($i = 0; $i <= $inputn; $i++) {
if($i !== $inputn) {
$data .= '$input[' . $i . "],";
} else {
$data .= '$input[' . $i . "]";
}
$sp .= "s";
}
$bind = '$stmt->bind_param(\''. $sp . '\',' . $data . ');';
eval("return $bind");
}
if (!$stmt) {throw new Exception($this->mysqli->error);}
$stmt->execute();
if (!$stmt) {throw new Exception($this->mysqli->error);}
$stmt->store_result();
$checker = $stmt->num_rows;
if($checker !== 0) {
if(!empty($output1)) {
$out = "";
for($i = 1; $i <= $output1; $i++) {
if($i !== $output1) {
$out .= '$out' . $i . ",";
} else {
$out .= '$out' . $i;
}
}
$res = '$stmt->bind_result(' . $out . ');';
eval("return $res");
$vars = "array(" . $out . ");";
while ($stmt->fetch()) {
$results[] = eval("return $vars");
}
}
} else {
$results = "NO RESULTS";
}
$stmt->fetch();
$stmt->close();
$this->results = array('num_rows' => $checker, $results);
return $this->results;
}
编辑meagar
$bind = '$stmt->bind_param(\''. $sp . '\',' . $data . ');';
==
$bind = '$stmt->bind_param('ss', $input[0], $input[1]););
OR and so on
$bind = '$stmt->bind_param('sss', $input[0], $input[1], $input[2]););
编辑隐身模式:
$input = array($_POST['pwnd']);
$data = readDB2($sql, $input, $output) {
public function readDB2($sql, $input, $output) {
...
$inputn = count($input) - 1;
for($i = 0; $i <= $inputn; $i++) {
if($i !== $inputn) {
$data .= '$input[' . $i . "],";
} else {
$data .= '$input[' . $i . "]";
}
$sp .= "s";
}
$bind = '$stmt->bind_param(\''. $sp . '\',' . $data . ');';
eval("return $bind");
...
}
我的结果
$bind = '$stmt->bind_param(\''. $sp . '\',' . $data . ');';
获取
eval("return $bind");
获取
$stmt->bind_param('s', $input[0]);
不是你所说的.
推荐答案
fyi, call_user_func_array ()是您如何调用参数数量未知的函数.
fyi, call_user_func_array() is how you call functions with unknown number of arguments.
array_unshift($input, str_repeat('s', count($input)));
$callable = array($stmt, 'bind_param');
call_user_func_array($callable, $input);
array_unshift ()将'sss'字符串元素推到数组的前面(我们希望前面,因为它必须是提供给bind_param的第一个参数)
array_unshift() pushes the 'sss' string element to the front of the array(we want the front because it needs to be the first argument fed to bind_param)
$ callable是回调伪类型
$callable is the callback psuedo type
此外,将来,如果您发现自己使用eval,请熟悉php的 var_export ()可以帮助您构造安全字符串的函数.尽量不要使用eval.
also, in the future, if you find yourself using eval, familiarize yourself with php's var_export() function which can assist you with constructing safe strings. Try not to use eval though.
这篇关于PHP eval()在我的代码中可被利用吗? (动态参数)的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!