亲测 YII2 SQL注入 [ 技术分享 ]

//是否开启了发送短信功能
// 可以注入到数据库
//$where = 'to_days(from_unixtime(send_time)) = to_days(now()) and id='.$tel;
//$count = self::find()->select('*')->where($where)->asArray()->all();
//echo self::find()->createCommand()->getRawSql();
//var_dump($count);

// 可以注入到数据库
//$sql     = "SELECT * FROM   xtrade_admin_send_notice WHERE id = {$tel}";
//$db      = \Yii::$app->db;
//$command = $db->createCommand($sql);//存在注入漏洞，方法内部并未对$id进行过滤或其它处理
//$result  = $command->queryAll();
//var_dump($result);



//测试没有注入漏洞
$sql     = "SELECT * FROM   xtrade_admin_send_notice WHERE id = :id";
$db      = \Yii::$app->db;
$command = $db->createCommand($sql, [':id'=>$tel]);//方法内部对第二个参数进行PDO参数化，不会导致注入漏洞
$result  = $command->queryAll();
var_dump($result);

//测试没有注入漏洞
$result = self::findAll("id={$tel}");
echo self::find()->createCommand()->getRawSql();
var_dump($result);

//测试没有注入漏洞
$id =$tel;
$result = self::findAll($id);
echo self::find()->createCommand()->getRawSql();
var_dump($result);

//测试没有注入漏洞
$result = self::findAll(['id'=>$tel]);
echo self::find()->createCommand()->getRawSql();
var_dump($result);

//测试没有注入漏洞
$res = self::find()->where('id=:id',array(':id'=>$tel))->asArray()->all();
echo self::find()->createCommand()->getRawSql();
var_dump($result);

最后结论：只要是ar形式的都可以防止