PHP PDO无法正常工作，仍能sql注入

Question

Thanks for the help everyone, I'm closer. I ended up putting the _GET into the bind instead of setting vars, didn't see a point in that. I wasn't sure which answer to put in the SELECT, so this sample has the '?''. I tried both though. I also changed the bindParam to the sample above (:careerID and ;title). The good news is the injection won't work, but the bad news is I cannot click on the link to view the description. Here is the edited code, again I appreciate any assistance!

$conn = new PDO('mysql:host=XXXX;dbname=XXXX', 'XXXX', 'XXXX');
    // set the PDO error mode to exception
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    // Leave column names as returned by the database driver
    $conn->setAttribute(PDO::ATTR_CASE, PDO::CASE_NATURAL);
    // Convert Empty string to NULL
    $conn->setAttribute(PDO::ATTR_ORACLE_NULLS, PDO::NULL_EMPTY_STRING);   



$SQL = "SELECT *
          FROM careerapplicationpost,careerapplicationjobdescription 
         WHERE careerapplicationpost.CareerApplicationPostID = '?'
           AND careerapplicationjobdescription.JobDescriptionTitle = '?'";

$sth = $conn->prepare($SQL);
// binding parameters 
$sth->bindParam(':careerId', $_GET['CareerID'], PDO::PARAM_INT, 100);
$sth->bindParam(':title', $_GET['Title'], PDO::PARAM_STR, 100);
  // executing statement
$sth->execute();
$resultSet = $sth->fetchAll();
foreach ( $conn->query($SQL) as $row ) {
        
    
                        
    //setup the postings
    echo "<h2>";
    echo "<a href=\"/careers/view-career.php?CareerID=$row[CareerApplicationPostID]&Title=$row[JobDescription]\">$row[JobDescriptionDisplayTitle]</a><br />"; 
    echo "</h2><hr />";
    echo "<br />";
    echo $row['Location'];
    echo ", &nbsp;&nbsp;";
    echo $row['FullTimePartTime'];
    echo  "<div class=\"postedon\">Posted on ";
    echo $row['PostedDate'];
    echo "</div>";
    echo "<br />";echo "<br />";
    echo "<strong>Summary:</strong>  ";
    echo $row['JobDescriptionSummary'];
    echo "<br />";echo "<br />";
    echo $row['JobDescriptionEdited'];
    echo "<div class=\"linebreak\">&nbsp;</div>";
    echo "<a href=\"/careers/files/DigiEmploymentApp.pdf\">Please fill out an application here.</a><br />";
    echo "<div class=\"clear\"></div>";
    echo "<hr />";    
}

    

if (!$row['CareerApplicationPostID'])
{
    
header("Location:index.php");
    exit;
    }
$conn = null;                     

</div>

Answer 1

You can easily fix your code:

$SQL = "SELECT *
          FROM careerapplicationpost,careerapplicationjobdescription 
         WHERE careerapplicationpost.CareerApplicationPostID = :careerId
           AND careerapplicationjobdescription.JobDescriptionTitle = :title";

$sth = $conn->prepare($SQL);
// binding parameters 
$sth->bindParam(':careerId', $careerId, PDO::PARAM_INT);
$sth->bindParam(':title', $title, PDO::PARAM_STR, 100);

Problem was that you passed a query with values already passed in the string variable $SQL because you used variable inside of "".