騰訊安全檢測報錯:
[10501]SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"\\%5C%0d%0a%23# * pi()) / 180) / 2), 2))))) AS distance,`id`,`name`,`phone`,`im' at line 1
[10501]SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '??""\\\## * pi()) / 180) / 2), 2))))) AS distance,`id`,`name`,`phone`,`image`,' at line 1
[10501]SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '??""\\\## * pi()) / 180) / 2), 2))))) AS distance FROM `aaa_system_store` WHER' at line 1
問題位置:如圖,SystemStoreDao文件 distance函數(shù)
問題原因:$latitude變量 字符串插值可能會導(dǎo)致 SQL 注入的安全問題
有沒有好的優(yōu)化方法?
【產(chǎn)品名稱】:多店版
【產(chǎn)品版本】:v2.6
【部署方式】:linux/
【部署環(huán)境】:線上環(huán)境
【php版本】:例:7.4
【Mysql版本】:例:5.7