Question

我通过ajax使用此结构发送一个javascript对象

[
  {  name:'box', price:'20', id:'72', units : 2 },
  {  name:'box2', price:'30', id:'73', units : 2 },
  {  name:'box3', price:'40', id:'74', units : 2 }
]

以这种方式在服务器上获取数据

$data = json_decode(file_get_contents("php://input"),true);
$queryconst = '';
foreach($data as $key => $value){
    $format[$key] = $value;
    $format_keys = array_keys($format[$key]);
    $newArray = $this->slashesToArray($value);
    $queryconst = $queryconst.'(\''.implode("','", $newArray).'\'),';           
}
$queryconst = rtrim($queryconst, ",");
$query = "INSERT INTO format (".implode(",", $format_keys).") VALUES ".$queryconst;

如果我发送的数据有一个对象

[
  {  name:'box', price:'20', id:'72', units : 2 }
]

一切正常

$query = INSERT INTO format (name,units,price,id) VALUES ('box','2','20','72')

当数据有多个对象时会出现问题

[
  {  name:'box', price:'20', id:'72', units : 2 },
  {  name:'box2', price:'30', id:'73', units : 2 },
  {  name:'box3', price:'40', id:'74', units : 2 }
]

和查询

$query = INSERT INTO format (price,name,units,product_id) 
         VALUES ('box','2','20','74'),('30','box2','2','74'),('40','box3','2','74')

第一个对象的顺序与其他对象不同，查询失败

有任何线索吗？

Answer 1

最后我修复了它，只是在循环开始时对数组进行排序

$data = json_decode(file_get_contents("php://input"),true);
$queryconst = '';
foreach($data as $key => $value){
    ksort($value);
    $format[$key] = $value;
    $format_keys = array_keys($format[$key]);
    $newArray = $this->slashesToArray($value);
    $queryconst = $queryconst.'(\''.implode("','", $newArray).'\'),';           
}
$queryconst = rtrim($queryconst, ",");
$query = "INSERT INTO format (".implode(",", $format_keys).") VALUES ".$queryconst;

Answer 2

JSON对象无序。规范或任何实现中的任何内容都不能保证在迭代，编码或解码JSON对象时的任何特定顺序。您必须明确使用对象键名称，而不是隐式依赖它们的顺序。

这些方面的东西：

$data = json_decode(file_get_contents("php://input"), true);

// this is your whitelisting against column injection
$allowedColumns = ['name', 'price', ...];
$columns = array_keys($data[0]);
if (array_diff($columns, $allowedColumns)) {
    throw new InvalidArgumentException;
}

$values = [];
foreach ($data as $row) {
    // this maps the values to the column names in the right order, including escaping
    $values[] = array_map(function ($column) use ($row) {
        return sprintf("'%s'", mysql_real_escape_string($row[$column]));
    }, $columns);
}

$query = sprintf(
    'INSERT INTO (%s) VALUES %s',
    join(', ', $columns),
    join(', ', array_map(function ($row) {
        return sprintf('(%s)', join(', ', $row));
    }, $values))
);

请注意使用mysql_real_escape_string进行正确转义。另请注意，这已被弃用，您应该将PDO或mysqli用于占位符和参数绑定。

php json_decode乱序数组

2 个答案: