看不见的字符之毒——对入参数没有强验证

self-confidence

于 2020-01-16 00:25:25 发布

阅读量204

点赞数

分类专栏： PHP

本文链接：https://blog.youkuaiyun.com/u012946588/article/details/103997821

版权

PHP 专栏收录该内容

11 篇文章

订阅专栏

看不见的字符之毒

/v1/pay/pay-query?pay_type=15&pay_sn=‌2020011420190534404
## pay_sn之前的等号删除重写，前面的？就消失了
			$pay_sn = $params['pay_sn'] ?? '';
            var_dump($pay_sn);
            $encode = mb_detect_encoding($pay_sn, array("ASCII",'UTF-8',"GB2312","GBK",'BIG5'));
            var_dump($encode);
            $pay_sn = mb_convert_encoding($pay_sn, 'ASCII', $encode);
            var_dump($pay_sn);

结果展示

PayLogic.php:2540:string '‌2020011420190534404' (length=22)
PayLogic.php:2542:string 'UTF-8' (length=5)
PayLogic.php:2544:string '?2020011420190534404' (length=20)
{"time":1579105329.221,"message":"ok","code":0,"status":200,"data":{"success":false,"msg":"找不到支付记录","data":[]}}