dsa122870 2009-10-28 09:18
浏览 65
已采纳

使用javascript和php通过ajax运行MySQL查询

I was looking through some code on a project of mine and thinking about all the php pages that I call with ajax that just run a simple update or insert query and it made me think. What if I could essentially run an insert or update sql query from javascript.

assuming I am using the prototype javascript framework for ajax and php on the server side.

would this work?

js:

<script type="text/javascript">
// table is string containing table name
// fields is an array of field names
// values is an array of values
function mysql_insert(table,fields,values) {
    var sql = "INSERT INTO " + table + "(";
    for(i=0; i<fields.length; i++) {
        sql = sql + "`"+fields[i]+"`";
    }
    sql = sql + ") VALUES (";
    // purposefully used fields array in for loop so we get matching number of values
    for(i=0; i < fields.length; i++) {
        sql = sql + "'"+values[i]+"'";
    }
    sql = sql + ");";

    var par = 'query='+sql;
    var ajax = new Ajax.Request('sql.php',{method:'post',parameters:par,onComplete:function(res) { }});
}
</script>

php:

<?php
    include('db.php');  // connect to the mysql server and select database
    mysql_query($_POST['query']);
?>

Obviously this is a simple example, just interested to know if this would work and I could replace the lot of small php pages that are each running a separate query?

  • 写回答

3条回答 默认 最新

  • doudi7782 2009-10-28 09:19
    关注

    Don't do that!

    It will allow anyone to do what ever he likes with your database!

    He would be able to send any sql command to your database.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(2条)

报告相同问题?

悬赏问题

  • ¥15 vue3+express部署到nginx
  • ¥20 搭建pt1000三线制高精度测温电路
  • ¥15 使用Jdk8自带的算法,和Jdk11自带的加密结果会一样吗,不一样的话有什么解决方案,Jdk不能升级的情况
  • ¥15 画两个图 python或R
  • ¥15 在线请求openmv与pixhawk 实现实时目标跟踪的具体通讯方法
  • ¥15 八路抢答器设计出现故障
  • ¥15 opencv 无法读取视频
  • ¥15 按键修改电子时钟,C51单片机
  • ¥60 Java中实现如何实现张量类,并用于图像处理(不运用其他科学计算库和图像处理库))
  • ¥20 5037端口被adb自己占了