search
HomeBackend DevelopmentPHP TutorialMybb1.8 database core operation update_query has low-level bugs causing data loss

In the process of upgrading Mybb1.6 to 1.8, we encountered numerous problems. Recently, we discovered a serious bug in the code of the core operation update_query of the Mybb1.8 database, which caused the leading zeros to be missed when the data was saved. After a few hours, I found that the fault was not with me, but with mybb's upgrade code.  

Data table: test 
field 
ID  int(10) AUTO_INCREMENT 
name varchar (60) not null 
category varchar(5) 

In this table, category represents the classification, and the classification is represented by common codes, a total of five The first two digits, 0l to 99, represent major categories, and the last three digits represent small categories. Update the text through Ajax in the update statement, and update the data through update_query in the background statement. The program worked normally at level 1.6, but the update was chaotic at level 1.8. After checking, I found that the "0" in front of the category field was missing. The problem cannot be solved by changing various means. Finally, I dug out the data operation core file of Mybb and compared it with version 1.6 and found that there was a low-level bug in the code, causing the error. 

下面是1.8版数据更新过程 

Php代码  

function update_query($table, $array, $where="", $limit="", $no_quote=false)  
{  
    global $mybb;  
  
    if(!is_array($array))  
    {  
        return false;  
    }  
  
    $comma = "";  
    $query = "";  
    $quote = "'";  
  
    if($no_quote == true)  
    {  
        $quote = "";  
    }  
  
    foreach($array as $field => $value)  
    {  
        if(isset($mybb->binary_fields[$table][$field]) && $mybb->binary_fields[$table][$field])  
        {  
            if($value[0] != 'X') // Not escaped?  
            {  
                $value = $this->escape_binary($value);  
            }  
              
            $query .= $comma."`".$field."`={$value}";  
        }  
        else  
        {  
            if(is_numeric($value))  
            {  
                $query .= $comma."`".$field."`={$value}";  
            }  
            else  
            {  
                $query .= $comma."`".$field."`={$quote}{$value}{$quote}";  
            }  
        }  
        $comma = ', ';  
    }  
  
    if(!emptyempty($where))  
    {  
        $query .= " WHERE $where";  
    }  
  
    if(!emptyempty($limit))  
    {  
        $query .= " LIMIT $limit";  
    }  
  
    return $this->write_query("  
        UPDATE {$this->table_prefix}$table  
        SET $query  
    ");  
}



而1.6版本是这样的 

Php代码  

function update_query($table, $array, $where="", $limit="", $no_quote=false)  
    {  
        if(!is_array($array))  
        {  
            return false;  
        }  
          
        $comma = "";  
        $query = "";  
        $quote = "'";  
          
        if($no_quote == true)  
        {  
            $quote = "";  
        }  
          
        foreach($array as $field => $value)  
        {  
            $query .= $comma."`".$field."`={$quote}{$value}{$quote}";  
            $comma = ', ';  
        }  
          
        if(!emptyempty($where))  
        {  
            $query .= " WHERE $where";  
        }  
          
        if(!emptyempty($limit))  
        {  
            $query .= " LIMIT $limit";  
        }  
  
        return $this->write_query("  
            UPDATE {$this->table_prefix}$table  
            SET $query  
        ");  
    }



发生错误的是这样几句 

Php代码  

if(is_numeric($value))  
            {  
                $query .= $comma."`".$field."`={$value}";  
            }  
            else  
            {  
                $query .= $comma."`".$field."`={$quote}{$value}{$quote}";  
            }


传过来category的值可能是01002或08003,只要is_numeric($value)为真就是数字类型?!这是什么逻辑。其时mysql能自动处理识别字符型和数字型的差别,升级的1.8版把简单的事情复杂化,错误的逻辑导致bug发生,导致传过来的由数字组成的字符串存入数据库时前面的0丢失。如果前面不为0,就不会出错,这样导致数据一片混乱。 

一直以来很欣赏Mybb简洁的代码和漂亮的系统架构,2M代码包括图片CSS等竟然能完成如此多的功能,给予用户良好的扩展能力。没想到翻出这样一个bug,见笑了。1.6至1.8改动很大,发布过于仓促。总体说来,Mybb不失一个漂亮简洁的php论坛。


Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Explain how load balancing affects session management and how to address it.Explain how load balancing affects session management and how to address it.Apr 29, 2025 am 12:42 AM

Load balancing affects session management, but can be resolved with session replication, session stickiness, and centralized session storage. 1. Session Replication Copy session data between servers. 2. Session stickiness directs user requests to the same server. 3. Centralized session storage uses independent servers such as Redis to store session data to ensure data sharing.

Explain the concept of session locking.Explain the concept of session locking.Apr 29, 2025 am 12:39 AM

Sessionlockingisatechniqueusedtoensureauser'ssessionremainsexclusivetooneuseratatime.Itiscrucialforpreventingdatacorruptionandsecuritybreachesinmulti-userapplications.Sessionlockingisimplementedusingserver-sidelockingmechanisms,suchasReentrantLockinJ

Are there any alternatives to PHP sessions?Are there any alternatives to PHP sessions?Apr 29, 2025 am 12:36 AM

Alternatives to PHP sessions include Cookies, Token-based Authentication, Database-based Sessions, and Redis/Memcached. 1.Cookies manage sessions by storing data on the client, which is simple but low in security. 2.Token-based Authentication uses tokens to verify users, which is highly secure but requires additional logic. 3.Database-basedSessions stores data in the database, which has good scalability but may affect performance. 4. Redis/Memcached uses distributed cache to improve performance and scalability, but requires additional matching

Define the term 'session hijacking' in the context of PHP.Define the term 'session hijacking' in the context of PHP.Apr 29, 2025 am 12:33 AM

Sessionhijacking refers to an attacker impersonating a user by obtaining the user's sessionID. Prevention methods include: 1) encrypting communication using HTTPS; 2) verifying the source of the sessionID; 3) using a secure sessionID generation algorithm; 4) regularly updating the sessionID.

What is the full form of PHP?What is the full form of PHP?Apr 28, 2025 pm 04:58 PM

The article discusses PHP, detailing its full form, main uses in web development, comparison with Python and Java, and its ease of learning for beginners.

How does PHP handle form data?How does PHP handle form data?Apr 28, 2025 pm 04:57 PM

PHP handles form data using $\_POST and $\_GET superglobals, with security ensured through validation, sanitization, and secure database interactions.

What is the difference between PHP and ASP.NET?What is the difference between PHP and ASP.NET?Apr 28, 2025 pm 04:56 PM

The article compares PHP and ASP.NET, focusing on their suitability for large-scale web applications, performance differences, and security features. Both are viable for large projects, but PHP is open-source and platform-independent, while ASP.NET,

Is PHP a case-sensitive language?Is PHP a case-sensitive language?Apr 28, 2025 pm 04:55 PM

PHP's case sensitivity varies: functions are insensitive, while variables and classes are sensitive. Best practices include consistent naming and using case-insensitive functions for comparisons.

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Atom editor mac version download

Atom editor mac version download

The most popular open source editor

DVWA

DVWA

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software

VSCode Windows 64-bit Download

VSCode Windows 64-bit Download

A free and powerful IDE editor launched by Microsoft

MantisBT

MantisBT

Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment