|
建议把以下功用也加上:
- function checkPrivilege(exe,fun,emp:string):boolean;
- function checkPrivilegeExist(exe,fun:string):boolean;
- function getValidSql(sql:string):string;
复制代码
PACK_CTN.exe已加入
function TDataModule1.checkPrivilege(exe, fun, emp: string): boolean;
var
mysql:string;
myday:string;
begin
mysql:='select 1 from sfc.c_privilege where prg_name='''+exe+''' and fun='''+fun+''' and emp='''+emp+''' and privilege=2 ';
mysql:=getValidSql(mysql);
self.MyQuery5.Close;
self.MyQuery5.SQL.Text:=mysql;
self.MyQuery5.Open;
result:=not self.MyQuery5.Eof;
self.MyQuery5.Close;
end;
function TDataModule1.checkPrivilegeExist(exe, fun: string): boolean;
var
mysql:string;
myday:string;
begin
mysql:='select 1 from sfc.c_privilege where prg_name='''+exe+''' and fun='''+fun+''' and privilege=2 limit 1 ';
mysql:=getValidSql(mysql);
self.MyQuery5.Close;
self.MyQuery5.SQL.Text:=mysql;
self.MyQuery5.Open;
result:=not self.MyQuery5.Eof;
self.MyQuery5.Close;
end;
//做一下简单的防SQL代码注入
function TDataModule1.getValidSql(sql: string): string;
begin
//注意,单引号应该在输入框过滤掉!
result:=sql;
AgileStrings.MyReplaceString(result,';','',false);
AgileStrings.MyReplaceString(result,'-- ','',false);
end; |
|