防止sql注入

source/application/api/controller/pass/Passcc.php

@@ -26,8 +26,8 @@ class Passcc extends Controller
     public function allGroupTimeNum()
     {
         $granularity = $this->request->param('granularity');
-        $groupsId = $this->request->param('groupsId');
-        $res = PassFlow::allGroupTimeNum(['granularity' => $granularity, 'groupsId' => $groupsId]);
+        $type = $this->request->param('type');
+        $res = PassFlow::allGroupTimeNum(['granularity' => $granularity, 'type' => $type]);
         if (empty($res['code'])) $this->renderError($res['msg']);
         $data = $res['data'];
         return $this->renderSuccess(compact('data'));
@@ -42,8 +42,8 @@ class Passcc extends Controller
      */
     public function allGroupNum()
     {
-        $groupsId = $this->request->param('groupsId') ?: '';
-        $returnData = PassFlow::allGroupNum(null,['groupsId' => $groupsId]);
+        $type = $this->request->param('type') ?: '';
+        $returnData = PassFlow::allGroupNum(null,['type' => $type]);
         return $this->renderSuccess(compact('returnData'));
     }
 
@@ -69,8 +69,8 @@ class Passcc extends Controller
      */
     public function toDayGroupsEnterNum()
     {
-        $groupsId = $this->request->param('groupsId') ?: '';
-        $data = PassFlow::toDayGroupsEnterNum(null,['groupsId' => $groupsId]);
+        $type = $this->request->param('type') ?: '';
+        $data = PassFlow::toDayGroupsEnterNum(null,['type' => $type]);
         return $this->renderSuccess(compact('data'));
     }
 

source/application/common/logic/PassFlow.php

@@ -7,6 +7,7 @@ use app\common\dm\Dm;
 class PassFlow
 {
     protected static $groupType = [1,2];# 1 = 体育 2 = 文化
+    protected static $granularity = ['daily','monthly','yearly'];# 1 = 体育 2 = 文化
 
     protected static function getGroupIds($dm,$type = 1)
     {
@@ -31,6 +32,7 @@ class PassFlow
         $type    = $param['type'];
 
         if (empty($granularity)) return ['code' => 0, 'msg' => '缺少参数：granularity'];
+        if (!in_array($granularity,self::$granularity)) return ['code' => 0, 'msg' => '参数错误：granularity'];
         $where = '';
         $groupsId = '';
         if (!empty($type)) {