这是我的代码:
$ost=$_GET['id']; //get the ID from the URL
$path = "audio/soundtracks/$ost"; //use the ID to select a path
// Open the folder
$dir_handle = @opendir($path) or die("Unable to open $path");
// Loop through the files
while ($file = readdir($dir_handle)) {
if($file == "." || $file == ".." || $file == "index.php" )
continue;
echo "<a href='$path/$file'>$file</a><br />"; //return the name of the track
}
// Close
closedir($dir_handle);
它的目的是自动列出目录中包含的每个音轨,其名称由通过 URL 传递的 ID 给出。每首曲目的命名格式为“### - title.mp3”,例如“101 - Overture.mp3”。
它工作正常,但由于某种原因,结果列表是随机排序的。有没有办法按标题对曲目进行排序?另外,我几乎是 PHP 的新手,GET 函数有什么安全问题吗?提前致谢。
编辑: GET 仅用于指定路径,它不应该与数据库交互。这足以防止攻击吗?
$ost = $_GET['id'];
$bad = array("../","=","<", ">", "/","\"","`","~","'","$","%","#");
$ost = str_replace($bad, "", $ost);
$path = "audio/soundtracks/$ost";