Pdo\Sqlite::setAuthorizer
(PHP 8 >= 8.5.0)
Pdo\Sqlite::setAuthorizer — Configures a callback to be used as an authorizer to limit what a statement can do
说明
public function Pdo\Sqlite::setAuthorizer(
?callable $callback):
void
Sets a callback that will be called by SQLite every time an action is performed
(reading, deleting, updating, etc.). This is used when preparing an SQL statement
from an untrusted source to ensure that the statement does not access data it is
not allowed to see or execute malicious statements that damage the database.
The authorizer is used only during the statement preparation phase.
It may be called several times for a single statement: a
SELECT or UPDATE query calls it for every
column that would be read or updated. It runs again whenever SQLite
re-prepares a statement, which may happen while the statement is being
executed, for instance after the schema has changed.
The authorizer is called with up to five arguments. The arguments received are
described at SQLite3::setAuthorizer().
Only a single authorizer can be in place on a database connection at a time.
Each call to this method overrides the previous one. The authorizer is disabled
by default, and can be disabled again by setting a null callback.
The callback must not modify the database connection that invoked it.
More details can be found in the
» SQLite documentation.
注意:
This method is the equivalent of SQLite3::setAuthorizer(),
except that it returns void instead of bool.
示例
示例 #1 Pdo\Sqlite::setAuthorizer() example
Only read actions are allowed on the connection. The action codes are exposed
as SQLite3 class constants, which requires the
SQLite3 extension to be available; their
integer values may be used directly otherwise.
<?php
$db = new Pdo\Sqlite('sqlite::memory:');
$db->exec('CREATE TABLE users (id, name)');
$db->setAuthorizer(function (int $action, ...$args) {
return match ($action) {
SQLite3::SELECT, SQLite3::READ => Pdo\Sqlite::OK,
default => Pdo\Sqlite::DENY,
};
});
var_dump($db->query('SELECT name FROM users') instanceof PDOStatement);
try {
$db->exec('DROP TABLE users');
} catch (PDOException $e) {
echo $e->getMessage(), "\n";
}
?>
bool(true)
SQLSTATE[HY000]: General error: 23 not authorized
