0

src/api/mps/mpsSchoolController.js

@@ -6,6 +6,11 @@ import commonModel from '../../model/commonModel.js';
 import mps, { ArrYear, getDistrict } from '../../model/mps.js';
 import _ from 'lodash';
 
+function toNumberParam(value, fallback = 0) {
+    const number = Number(value);
+    return Number.isFinite(number) ? number : fallback;
+}
+
 /**
  * 得到所有区
  */
@@ -570,7 +575,7 @@ export async function GetMPSSchoolWeb(ctx) {
 //得到用户收藏学校
 export async function GetMPSSchoolCollect(ctx) {
     const param = {
-        UserID: ctx.query.UserID || 0,
+        UserID: toNumberParam(ctx.query.UserID),
     };
     
     const result = {};
@@ -602,9 +607,9 @@ export async function GetMPSSchoolCollect(ctx) {
 //更新收藏学校
 export async function UpdateMPSSchoolCollect(ctx) {
     const param = {
-        UserID: ctx.query.UserID || 0,
-        SchoolID: ctx.query.SchoolID || 0,
-        IsCollect: ctx.query.IsCollect || 0,
+        UserID: toNumberParam(ctx.query.UserID),
+        SchoolID: toNumberParam(ctx.query.SchoolID),
+        IsCollect: toNumberParam(ctx.query.IsCollect),
     };
     let sql = "delete from MPS_UserCollect where UserID=" + param.UserID + " and SchoolID=" + param.SchoolID;
     await commonModel.RunSql({}, sql);

src/app.js

@@ -94,6 +94,7 @@ app.use(internalRouter.allowedMethods());
 
 //中间件
 app.use(decryptUrlMiddle());
+app.use(queryParamSanitizer());
 
 // 注册路由
 app.use(commonRouter.routes());