PHP 原生查询性能与安全优化实战
在实际开发中,直接拼接 SQL 字符串是常见的隐患。下面这段代码展示了典型的查询逻辑,虽然功能上能跑通,但在安全性和性能上存在明显短板。
原始问题分析
观察以下实现方式:
// 井不为空时
if ($productId != '') {
$data = $this->getQueryStatement($productId, $m_intSTime, $m_intETime)['query1'];
return $this->getCommonValue($data);
} elseif ($productId == '') {
$data = $this->getQueryStatement($productId, $m_intSTime, $m_intETime)['query2'];
return $this->getCommonValue($data);
}
// 查询语句
private function getQueryStatement($productId, $m_intSTime, $m_intETime) {
// 第一个查询语句
$query1 = "SELECT a.SERIAL, a.COMMANDID, a.CELLID, a.USERID, a.LIBTIME, a.[RETURN], a.VALUE, a.USERALIAS, (SELECT NAME FROM system_index WHERE ID = a.CELLID) AS NAME FROM system_command AS a WHERE a.CELLID IN (SELECT ID FROM system_index WHERE PARENTID = '{$productId}') AND a.LIBTIME BETWEEN '{$m_intSTime}' AND ''";
= ;
[ => , => ];
}
{
= ->da->();
(->strState == ) {
= ->Data->(PDO::);
}
( = ; < (); ++) {
= ;
= ->da->();
(->strState == ) {
= ->Data->(PDO::);
}
([][] === ) {
[][] = [][];
} {
= ;
= ->da->();
(->strState == ) {
= ->Data->(PDO::);
}
[][] = [][];
}
}
();
}

