fix: 修复getviewcount()方法SQL注入漏洞

app/base/lib/db/tools.php

@@ -125,14 +125,27 @@ class base_db_tools{
     }
 
     static function filter2sql($filter){
+        $db = kernel::database();
         $where = array('1');
+        
+        // format filter to array
         if ($filter) {
             foreach ($filter as $k => $v) {
+                // Column name hardening: only allow simple identifiers
+                $k = (string)$k;
+                if ($k === '' || !preg_match('/^[a-zA-Z0-9_]+$/', $k)) {
+                    continue;
+                }
+                $col = '`' . $k . '`';
+                
                 if (is_array($v)) {
                     $ac = array();
                     foreach ($v as $m) {
                         if ($m !== '_ANY_' && $m !== '' && $m != '_ALL_') {
-                            $ac[] = $k.'=\''.$m.'\'';
+                            if ($m === null) {
+                                $m = '';
+                            }
+                            $ac[] = $col . ' = ' . $db->quote($m);
                         } else {
                             $ac = array();
                             break;
@@ -142,10 +155,14 @@ class base_db_tools{
                         $where[] = '(' . implode(' or ', $ac) . ')';
                     }
                 } else {
-                    $where[] = '`'.$k.'` = "'.str_replace('"','\\"',$v).'"';
+                    if ($v === null) {
+                        $v = '';
+                    }
+                    $where[] = $col . ' = ' . $db->quote($v);
                 }
             }
         }
+        
         return implode(' AND ', $where);
     }