échapper des valeurs $_POST servant à la connection
Le code suivant est appelé en ajax,
j'ai besoin de protéger et d'échapper les variables $POST notamment $user_id,
mais cette variable user_id sert à me connecter, et donc la connection ne peut pas se faire car real_escape_string ne peut se faire sans connection.
comment securiser autrement $user_id ? merci d'avance
fichier php :
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
<?php
include ("dbconfig.php");
error_reporting(E_ALL);
ini_set("display_errors", 1);
header("Access-Control-Allow-Origin: *");
$user_id = $dbcon ->real_escape_string(strip_tags($_GET['user_id'],ENT_QUOTES));
$current_file = $dbcon ->real_escape_string(strip_tags($_GET['current_file'],ENT_QUOTES));
$user_token = $dbcon ->real_escape_string(strip_tags($_POST['user_token'],ENT_QUOTES));
$geojson = array(
'type' => 'FeatureCollection',
'features' => array()
);
try {
$dbcon = new PDO("pgsql:host=".$pghost.";port=".$pgport.";dbname=mfy_".$user_id.";user=".$pguser.";password=".$pgpass."");
$dbcon->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $dbcon->prepare("SELECT cat, public.ST_AsGeoJSON(public.ST_Transform((geom),4326),6) AS geojson FROM :current_file._linestring");
$stmt->bindValue(":currentfile", $current_file, PDO::PARAM_INT);
if($stmt->execute()){
$id_count = 0;
while($rowset = $stmt->fetch(PDO::FETCH_ASSOC)){
$properties = $rowset;
unset($properties['geojson']);
unset($properties['geom']);
$feature = array(
'type' => 'Feature',
'id' => $id_count,
'properties' => $properties,
'geometry' => json_decode($rowset['geojson'], true)
);
array_push($geojson['features'], $feature);
$id_count++;
}
header('Content-Type: application/json');
echo json_encode($geojson, JSON_NUMERIC_CHECK);
$dbcon = null;
exit;
} else {
header('Content-Type: application/json');
echo json_encode($geojson, JSON_NUMERIC_CHECK);
$dbcon = null;
exit;
}
} catch (PDOException $e) {
header('Content-Type: application/json');
echo json_encode($geojson, JSON_NUMERIC_CHECK);
$dbcon = null;
exit;
}
?> |
exemple type d'appel ajax depuis javascript : le traitement de la réponse n'est pas indiqué mais est maitrisé. Ce sont des variables en javascript qui sont envoyés à php.
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| function rowcounter() {
rowcount = $.ajax({
url: "../crud/dataservice/count_tracks2.php",
method: "GET",
dataType: "json",
data: {
command: "LINESTRING",
current_file: current_file,
cat: "track1",
user_id: user_id,
},
xhrFields: {
withCredentials: true
},
username: null,
password: null
});
// response2 = rowcount.responseText;
// console.log(response2);
}; |
fichier dbconfig.php :
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
$pgconfig = array (
"_pgsql_db_host_" => "localhost",
"_pgsql_db_port_" => "5432",
"_pgsql_db_user_" => "userpg",
"_pgsql_db_pass_" => "mdpp",
"_pgsql_db_name_" => "nothing" );
$pghost = $pgconfig['_pgsql_db_host_'];
$pgport = $pgconfig['_pgsql_db_port_'];
$pguser = $pgconfig['_pgsql_db_user_'];
$pgpass = $pgconfig['_pgsql_db_pass_'];
$pgname = $pgconfig['_pgsql_db_name_'];
?> |
