我正在尝试在我的网站上创建动态搜索功能,用户可以选择根据 ID、品牌、型号或日期查找索赔信息。有一个搜索栏可用于输入数据,单选按钮提供搜索过滤器。
我想知道我的简单 if 语句方法是否存在 SQL 注入漏洞,因为我直接将变量作为列名传递(据我所知,PDO 不会让您将此值作为参数传递)
HTML 代码:
<form method="POST" action="find-claims.php">
<label for="find-claim">Find Claim:</label>
<input type="search" id="claim-search-bar" name="claim-search-bar"><br/>
<input type="radio" value="by-id" class="radio-param" name="search-param" checked><label for="by-id">By Claim Id</label>
<input type="radio" value="by-make" class="radio-param" name="search-param"><label for="by-make">By Vehicle Make</label>
<input type="radio" value="by-model" class="radio-param" name="search-param"><label for="by-model">By Vehicle Model</label>
<input type="radio" value="by-date" class="radio-param" name="search-param"><label for="by-date">By Claim Date</label>
<input type="submit" class="radio-param" value="Submit">
</form>
PHP代码:
// Get search data
$searchVal = $_POST["claim-search-bar"];
// Get radio value
$searchType = $_POST["search-param"];
// Store search type into db-naming scheme
$radioVal = "";
if($searchType == "by-id"){
$radioVal = "claim_id";
}
else if($searchType == "by-make"){
$radioVal = "make";
}
else if($searchType == "by-model"){
$radioVal = "model";
}
else if($searchType == "by-date"){
$radioVal = "date_received";
}
// DB Interaction
try{
// Connection to DB
require "../db-info.php";
$dbh = new PDO("mysql:host=$serverName; dbname=$dbName", $userName, $password);
$dbh->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
// Get Claim based off dynamic input
$getClaim = $dbh->prepare("SELECT * FROM claims WHERE $radioVal = ?");
$getClaim->bindParam(1, $searchVal);
$getClaim->execute();
$claimInfo = $getClaim->fetchAll();
// Checks if DB returned any data
if($claimInfo){
// Display corresponding info
}
慕桂英3389331
心有法竹