Laravel has been exploited, but I don't know how it was exploited. Please solve it.-PHP Tutorial-php.cn

Laravel has been exploited, but I don't know how it was exploited. Please solve it.

WBOY

Release： 2023-03-03 10:36:01

Original

1350 people have browsed it

<code>public function postStore(Request $request){
    
        switch ($request->input('type')) { //对提交过来的type进行判断
            case 'redBagCart':
                $type=1;
                $order_type='HB';
                break;
            
            default:
                $type=0;
                $order_type='WX';
                break;
        }
    
         ...
         
        Log::info($request->input('type')); //记录到日志里

})
</code>

Copy after login

The code is probably as above, but the strange thing is that my database has a record of this $order_type. The database records HB, that is, $request->input('type') is redBagCart, but What is recorded in the log is '', empty.
Why is this happening?

Reply content:

<code>public function postStore(Request $request){
    
        switch ($request->input('type')) { //对提交过来的type进行判断
            case 'redBagCart':
                $type=1;
                $order_type='HB';
                break;
            
            default:
                $type=0;
                $order_type='WX';
                break;
        }
    
         ...
         
        Log::info($request->input('type')); //记录到日志里

})
</code>

Copy after login

Where does $data['provinceName'] come from?
Log::info('mylog', ['type'=>$request->input('type')]);

You can try assigning $request->input('type') to a variable and then use it