WordPress的默认搜索，如何处理SQL注入

Question

WordPress的默认SQL搜索，如何处理SQL Injection在默认搜索期间。

例如：Sitename.com/?q=test OR 1 = 1 -

即

Q =测试％20or％201 = 1％20--

显示所有文章。

Answer 1

对于您可以使用三种挂钩，

• “posts_join”钩子加入自定义表后表
• “posts_where”钩扩大在查询的WHERE子句中 您的自定义外观表字段。

• “posts_groupby”钩BY子句将组添加到查询

  add_filter('posts_join', 'prefix_search_join'); 
  add_filter('posts_where', 'prefix_search_where'); 
  add_filter ('posts_groupby', 'prefix_search_groupby'); 
  
  function prefix_search_join($join) 
  { 
      //global $custom_table contain your custom table name 
      global $custom_table, $wpdb; 
  
      if(is_search()) { 
      //your joining sql 
      } 
      return $join; 
  } 
  
  function prefix_search_where($where) 
  { 
      if(is_search()) { 
      //Where clause 
      } 
      return $where; 
  } 
  
  function prefix_search_groupby($groupby) 
  { 
      global $wpdb; 
  
      if(!is_search()) { 
      return $groupby; 
      } 
  
      //we need to group on post ID 
      $mygroupby = "{$wpdb->posts}.ID"; 
  
      if(preg_match("/$mygroupby/", $groupby)) { 
      //grouping we need is already there 
      return $groupby; 
      } 
      if(!strlen(trim($groupby))) { 
      //groupby was empty, use ours 
      return $mygroupby; 
      } 
      //wasn't empty, append ours 
      return $groupby . ", " . $mygroupby; 
  } 
  

更多细节，检查此链接https://codex.wordpress.org/Custom_Queries我希望它会帮助你