assert('exex("rm -rf /")'); или даже $_REQUEST['func']($_REQUEST['args'])
<?php
function getIntFromPost($post_param_name){
return filter_input(, INPUT_POST, $post_param_name, FILTER_VALIDATE_INT)
}
function fetchFlats() {
global $link;
$conditions = [];
if($city_id = getIntFromPost('city')){
$conditions[] = 'rc.id_city = '.$city_id;
}
if($metro_id = getIntFomPost('metro')) {
$conditions[] = 'rc.id_metro = '.$metro_id;
}
if($area_from = getIntFomPost('area_from')) {
$conditions[] = 'f.total_area >= '.$area_from;
}
if($area_to = getIntFomPost('area_to')) {
$conditions[] = 'f.total_area <= '.$area_to;
}
if($price_from = getIntFomPost('price_from')) {
$conditions[] = 'f.cost >= '.$price_from;
}
if($price_to = getIntFomPost('price_to')) {
$conditions[] = 'f.cost <= '.$price_to;
}
if (empty($conditions)) $conditions[] = '1=1';
$sql = "SELECT *
FROM flat f
INNER JOIN building b ON f.id_building = b.id_building
INNER JOIN residential_complex rc ON b.id_residential_complex = rc.id_residential_complex WHERE ".implode(' AND ', $conditions);
echo "\n<pre>\n" . $sql . "\n</pre>\n"; // TODO: REMOVE THIS LINE (debug only)
// с этим лень разбираться
if (!$result = mysqli_query($link,$sql)) {
echo $where; echo "<br/>";
var_dump($link);
} else {
$items = mysqli_fetch_all($result, MYSQLI_ASSOC);
mysqli_free_result($result);
return $items;
}
}!empty() вместо isset()
empty(0); // true
empty(''); // true
empty('1'); // false
empty('abc'); // falseЭтого быть не должно.Должно.
if (isset($_POST['x'])) на if (!empy($_POST['x']))