} catch (Exception $e) { } asrt(in_array("hack", $adapter->getCol("show tables")), true); $bean->{$evil} = 1; try { $redbean->store($bean); } catch (Exception $e) { } asrt(in_array("hack", $adapter->getCol("show tables")), true); try { $redbean->trash($bean); } catch (Exception $e) { } asrt(in_array("hack", $adapter->getCol("show tables")), true); try { Finder::where("::"); } catch (Exception $e) { pass(); } $adapter->exec("drop table if exists sometable"); testpack("Test RedBean Security - query writer"); try { $writer->createTable("sometable` ( `id` INT( 11 ) UNSIGNED NOT NULL AUTO_INCREMENT , PRIMARY KEY ( `id` ) ) ENGINE = InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci ; drop table hack; --"); } catch (Exception $e) { } asrt(in_array("hack", $adapter->getCol("show tables")), true); //print_r( $adapter->get("select id from page where id = 1; drop table hack") ); //asrt(in_array("hack",$adapter->getCol("show tables")),true); //$bean = $redbean->load("page","13);show tables; "); //exit; testpack("Test ANSI92 issue in clearrelations");
/** * Finds a bean using a type and a where clause (SQL). * As with most Query tools in RedBean you can provide values to * be inserted in the SQL statement by populating the value * array parameter; you can either use the question mark notation * or the slot-notation (:keyname). * The variation also exports the beans (i.e. it returns arrays). * @param string $type * @param string $sql * @param array $values * @return array $arrays */ public static function findAndExport($type, $sql = "1", $values = array()) { $items = Finder::where($type, $sql, $values); $arr = array(); foreach ($items as $key => $item) { $arr[$key] = $item->export(); } return $arr; }
/** * Finds a bean using a type and a where clause (SQL). * As with most Query tools in RedBean you can provide values to * be inserted in the SQL statement by populating the value * array parameter; you can either use the question mark notation * or the slot-notation (:keyname). * @param string $type * @param string $where * @param array $values * @return array $beans */ public static function find($type, $where = "1", $values = array()) { return Finder::where($type, $where, $values); }