帮助中心-

B2C商城开发手册基础教程

本补丁由 QQ 木偶人提供

首先在 www\Application\Common\Common\function.php 文件添加一个方法

/**

 * 转换SQL关键字

*

 * @param unknown_type $string

 * @return unknown

*/

function strip_sql($string) {

    $pattern_arr = array(

            "/\bunion\b/i",

            "/\bselect\b/i",

            "/\bupdate\b/i",

            "/\bdelete\b/i",

            "/\boutfile\b/i",

            "/\bor\b/i",

            "/\bchar\b/i",

            "/\bconcat\b/i",

            "/\btruncate\b/i",

            "/\bdrop\b/i",            

            "/\binsert\b/i", 

            "/\brevoke\b/i", 

            "/\bgrant\b/i",      

            "/\breplace\b/i", 

            "/\balert\b/i", 

            "/\brename\b/i",            

            "/\bmaster\b/i",

            "/\bdeclare\b/i",

            "/\bsource\b/i",

            "/\bload\b/i",

            "/\bcall\b/i", 

            "/\bexec\b/i",         

            "/\bdelimiter\b/i",            

);

    $replace_arr = array(

            'ｕｎｉｏｎ',

            'ｓｅｌｅｃｔ',

            'ｕｐｄａｔｅ',

            'ｄｅｌｅｔｅ',

            'ｏｕｔｆｉｌｅ',

            'ｏｒ',

            'ｃｈａｒ',

            'ｃｏｎｃａｔ',

            'ｔｒｕｎｃａｔｅ',

            'ｄｒｏｐ',            

            'ｉｎｓｅｒｔ',

            'ｒｅｖｏｋｅ',

            'ｇｒａｎｔ',

            'ｒｅｐｌａｃｅ',

            'ａｌｅｒｔ',

            'ｒｅｎａｍｅ',

            'ｍａｓｔｅｒ',

            'ｄｅｃｌａｒｅ',

            'ｓｏｕｒｃｅ',

            'ｌｏａｄ',

            'ｃａｌｌ',                     

            'ｅｘｅｃ',         

            'ｄｅｌｉｍｉｔｅｒ',

);

    return is_array($string) ? array_map('strip_sql', $string) : preg_replace($pattern_arr, $replace_arr, $string);

}