admin管理员组

文章数量:1023230

I have a function that takes inputs that will be used for keywords in the query. I want to use placeholders for these things in the query string, as otherwise there will be a sqli vulnerability.

Here's my function:

 function get_things ($args = array()) {
  global $wpdb;

  $sql = $wpdb->prepare(
    "SELECT * FROM " . $wpdb->prefix . "my_table ORDER BY %s %s",
     $args['order_by'],
     $args['order']
  );

  $results = $wpdb->get_results($sql);
}

The second placeholder will be a MySQL keyword (either ACS or DESC). The problem with the above function is that the keyword will be wrapped in quotes. How can I fix this, whilst not creating a sqli vulnerability?

Also, the first placeholder (which will be a column name) is also being wrapped in quotes, which I don't want and is causing issues.

I have a function that takes inputs that will be used for keywords in the query. I want to use placeholders for these things in the query string, as otherwise there will be a sqli vulnerability.

Here's my function:

 function get_things ($args = array()) {
  global $wpdb;

  $sql = $wpdb->prepare(
    "SELECT * FROM " . $wpdb->prefix . "my_table ORDER BY %s %s",
     $args['order_by'],
     $args['order']
  );

  $results = $wpdb->get_results($sql);
}

The second placeholder will be a MySQL keyword (either ACS or DESC). The problem with the above function is that the keyword will be wrapped in quotes. How can I fix this, whilst not creating a sqli vulnerability?

Also, the first placeholder (which will be a column name) is also being wrapped in quotes, which I don't want and is causing issues.

本文标签： wpdb prepare placeholders for MySQL keywords

版权声明：本文标题：wpdb prepare placeholders for MySQL keywords 内容由热心网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：http://it.en369.cn/questions/1745516788a2154103.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。