php - 是否可以获得cpanel mysql数据库前缀？

Question

$db_connection = $_SERVER['DOCUMENT_ROOT'] . '/includes/install/database_connection.php';
if (!file_exists($db_connection)) {
    require("install/xmlapi.php");
    if (isset($_POST['cpname'])) {
        $opts['user'] = $_POST['cpname'];
        $opts['pass'] = $_POST['cppass'];
        $opts['temp'] = substr(str_shuffle(md5(time())),0,'12');
        $xmlapi = new xmlapi($_SERVER['HTTP_HOST']);
        $xmlapi->set_port( 2083 );
        $xmlapi->password_auth($opts['user'],$opts['pass']);
        $xmlapi->set_debug(0);
        $cpaneluser=$opts['user'];
        $databasename="OSMP_DAT";
        $databaseuser="OSMP_admin";
        $databasepass=$opts['temp'];
        $db = $databasename;
        $user = $databaseuser;
        $pass = $databasepass;
        $loc = 'localhost';
        $createdb = $xmlapi->api1_query($cpaneluser, "Mysql", "adddb", array($databasename));
        $usr = $xmlapi->api1_query($cpaneluser, "Mysql", "adduser", array($databaseuser, $databasepass));
        $addusr = $xmlapi->api1_query($cpaneluser, "Mysql", "adduserdb", array("".$cpaneluser."_".$databasename."", "".$cpaneluser."_".$databaseuser."", 'all'));
        include ('install/installer.php');
        exit;
    }
    if (!isset($_POST['dbhost'])) { include ('install/db_installer.php'); }
    if (isset($_POST['dbhost'])) {
            // save connection details to $db_connection
    }
}

上面的代码正如人们所期望的那样完美地工作。

首先它检查database_connection.php是否存在。如果存在，它包含包含数据库详细信息的文件。

如果没有 - 我们假设这是第一次安装。因此，我们要求用户提供 cpanel 登录详细信息，我们的脚本创建数据库并将详细信息保存到 database_connection.php。

唯一的问题...是数据库前缀。创建数据库时，如果 WHM 为用户帐户设置了数据库前缀，则数据库前缀将作为数据库名称的前缀。

我想知道如何确定是否有前缀，如果有，如何找出它是什么，以便脚本也可以在数据库名称上添加前缀。

注意我不是在寻找表前缀，而是由 cpanel/whm 添加的数据库前缀

Answer 1

显然，如果启用前缀，cpanel 默认情况下会使用用户名的前 8 个字符，后跟下划线。这用于数据库和数据库名称。

所以我简单地将上面的代码修改如下:

$db_connection = $_SERVER['DOCUMENT_ROOT'] . '/includes/install/database_connection.php';
if (!file_exists($db_connection)) {
    require("install/xmlapi.php");
    if (isset($_POST['cpname'])) {
        $opts['user'] = $_POST['cpname'];
        $prefix = substr($opts['user'],0,8).'_';
        if ($prefix === FALSE) {$prefix = $opts['user'];}
        $opts['pass'] = $_POST['cppass'];
        $opts['temp'] = substr(str_shuffle(md5(time())),0,'12');
        $xmlapi = new xmlapi(localhost);
        $xmlapi->set_port( 2083 );
        $xmlapi->password_auth($opts['user'],$opts['pass']);
        $xmlapi->set_debug(1);
        $cpaneluser=$opts['user'];
        $databasename="OSMP_DAT";
        $databaseuser="osmp";
        $databasepass=$opts['temp'];
        $pass = $databasepass;
        $loc = 'localhost';
        $createdb = $xmlapi->api1_query($cpaneluser, "Mysql", "adddb", array($databasename));
        $usr = $xmlapi->api1_query($cpaneluser, "Mysql", "adduser", array($databaseuser, $databasepass));
        $addusr = $xmlapi->api1_query($cpaneluser, "Mysql", "adduserdb", array($databasename, $databaseuser, 'all'));
        $db = $prefix.$databasename;
        $user = $prefix.$databaseuser;
        include ('install/installer.php');
        exit;
    }
    if (!isset($_POST['dbhost'])) { include ('install/db_installer.php'); }
    if (isset($_POST['dbhost'])) {
        // save connection details to $db_connection
    }
}

现在进行检查以确定用户名的长度，如果超过 8 个字符，则将其截断为 8 个。然后添加底层存储并作为变量输出以传递到脚本的下一部分。

我能看到的唯一缺陷是主机是否禁用了 whm 中的前缀，所以我一切顺利。

For anyone attempting to use this code in the future - make note you need to secure the included files or you are going to have whopping security problems. As this code stands someone could manually call install/db_installer.php or install/installer.php and bypass the (!file_exists($db_connection)) check and the if (isset($_POST)) and the (!isset($_POST['dbhost'])).

如果您不知道如何保护此代码，请勿使用此代码!