http.responseText返回名为的PHP函数的名称

Question

I am using AJAX to call a function within PHP. It returns my data fine but, it keeps putting the function name at the beginning of the returnText.

My Javascript/ajax

function getfirst() {
    var myphp=document.getElementById('myphp').value ;
    http=createRequestObject();
    url= tablename + '.php?filename=' + tablename;
    url= url + '&function=movefirst';
    url= url + '&seekindex=CustomerKey';
    url= url + '&maxdata=' + maxdata;
    http.open('GET',url,false);
    http.send(null);
    document.getElementById('myreturn').value;
}

MY PHP

<?php include '../../tophat.php';

$_REQUEST['function']();

function movefirst(){
    $filename=$_REQUEST['filename'];
    $seekindex=$_REQUEST['seekindex'];
    $maxdata=$_REQUEST['maxdata'];
    opendbdata();
    $query="SELECT * FROM ". $filename . " ORDER BY " . $seekindex; 
    $result=mysql_query($query);
    $returnkey='';
    for ($i=0; $i<=$maxdata-1; $i++)  {
         $returnkey = $returnkey . mysql_result($result,0,$i) . "~";
    }
    echo $returnkey;
}

I'm looking up the first customer in my customer database it returns the record but at the beginning of the returnText is the name of the function. Here is the beginning of the .returnText: "movefirst4SEASONS1~4 Seasons Pottery~336 Hammond Dr NE~"

I have never had this problem before. Thanks in advance for your help.

Answer 1

Note that you

• allow users to execute any functions that are available in this scope (something like dropDatabase() or rebootServer()) since you're invoking $_REQUEST['function']
• allow users to make any changes in your database or read secret information by taking advantage of SQL Injection!