伪造mysqli库中的错误条件

Question

我有各种各样的PHP脚本,它们使用mysqli这套函数来访问数据库.我编写了这些脚本来处理各种错误条件(例如mysqli_stmt_execute返回false).

是否有一种简单的方法可以伪造这些错误条件,以验证用户收到的输出是否符合这些条件？

Answer 1

如果您使用的是mysqli类.

例如:

<?php
     $mysqli = new mysqli("localhost", "user", "password", "db");
     $query = "INSERT INTO some_table (some_field) VALUES ('some_vale')";
     $stmt = $mysqli->prepare($query);
     if (false === $stmt->execute()) {
         echo "Oops! some_value for same_field in some_table returned false";
     }

模拟类和覆盖语句执行.

<?php
    class my_mysqli extends mysqli
    {
        public function prepare ($query)
        {
            return new my_mysqli_stmt();
        }

    }

    class my_mysqli_stmt extends mysqli_stmt {
        public function execute ()
        {
            return false;
        }
    }

所有你需要更改以使每个execute方法返回false是:

<?php
     $mysqli = new my_mysqli("localhost", "user", "password", "db");

如果您正在使用这些功能

例如:

<?php
     $mysqli = mysqli_connect("localhost", "user", "password", "db");
     $query = "INSERT INTO some_table (some_field) VALUES ('some_vale')";
     $stmt = mysqli_prepare($mysqli, $query);
     if (false === mysqli_stmt_execute($stmt)) {
         echo "Oops! some_value for same_field in some_table returned false";
     }

名称空间php> = 5.3中的猴子补丁

<?php
    namespace my_faking_namespace {
        function mysqli_stmt_execute($stmt) 
        {
            return false;    
        }

        $mysqli = mysqli_connect("localhost", "user", "password", "db");
        $query = "INSERT INTO some_table (some_field) VALUES ('some_vale')";
        $stmt = mysqli_prepare($mysqli, $query);
        if (false === mysqli_stmt_execute($stmt)) {
            echo "Oops! some_value for same_field in some_table returned false";
        }
    }

你的脚本将调用my_faking_namespace\mysqli_stmt_execute()而不是php版本.

注意:如果您正在调用函数,这将无法正常工作,\mysqli_stmt_execute()因为此版本显式调用全局命名空间.

完成目的不是那么容易的替代方案

这些修改了调用堆栈级别的函数,通过使用自定义扩展模块在内部更改php(需要安装).

• 高级PHP调试器有override_function()和rename_function()
• runkit有runkit_function_copy,runkit_function_redefine,runkit_function_remove,runkit_function_rename并且可以改变只是你想要什么.

的nJoy!