0

所以我有这个PHP函数：

public static function findByPageAndFieldContains($recordsPerPage, $page, $field, $searchterm) {
    $query = CouchbaseN1qlQuery::fromString('SELECT * FROM `public_portal` WHERE `collection`=$collection AND `'.$field.'` LIKE "%'.$searchterm.'%" ORDER BY `_id` limit $limit offset $offset');
    $query->options['$collection'] = static::COLLECTION_NAME;
    //$query->options['$field'] = $field;
    $query->options['$limit'] = $recordsPerPage;
    $query->options['$offset'] = $recordsPerPage*($page-1);
    //$query->options['$searchterm'] = $searchterm;

    $result = DB::getDB()->query($query);
    //var_dump($query);
    //var_dump($result);
    $objects = array();
    foreach($result as $row) {
        $object = new static($row->{"public_portal"});
        $object->setId($row->{"public_portal"}->{"_id"});
        $objects[] = $object;
    }
    //var_dump($objects);
    return $objects;
}

此查询容易受到 n1ql 注入的影响。我知道。为什么？当我使用占位符（现在已评论）时，它没有给我任何结果。如果我不能解决它，我会发布第二个问题。

这里我想问的问题是：这个函数在用户搜索的时候成功找到了文档。但是当字段是整数时，不会给出结果。我尝试用“=”替换 LIKE 并删除了引号和 %。然后用户可以成功地在整数字段中搜索数字。但随后用户无法再搜索字符串字段。有任何想法吗？

4

1 回答 1

1

我知道了。我刚刚在 n1ql 语句中添加了一个 TOSTRING()，它现在适用于字符串和 int。

public static function findByPageAndFieldContains($recordsPerPage, $page, $field, $searchterm) {
    $query = CouchbaseN1qlQuery::fromString('SELECT * FROM `public_portal` WHERE `collection`=$collection AND TOSTRING('.$field.') LIKE "%'.$searchterm.'%" ORDER BY `_id` limit $limit offset $offset');
    $query->options['$collection'] = static::COLLECTION_NAME;
    //$query->options['$field'] = $field;
    $query->options['$limit'] = $recordsPerPage;
    $query->options['$offset'] = $recordsPerPage*($page-1);
    //$query->options['$searchterm'] = $searchterm;

    $result = DB::getDB()->query($query);
    //var_dump($query);
    //var_dump($result);
    $objects = array();
    foreach($result as $row) {
        $object = new static($row->{"public_portal"});
        $object->setId($row->{"public_portal"}->{"_id"});
        $objects[] = $object;
    }
    //var_dump($objects);
    return $objects;
    return $result;
}
于 2016-07-08T13:29:39.503 回答