TYPO3 11自定义页面标题与防SQL注入技术求助

1. Sync H1 Tag with Custom TitleProvider Output #

Since you’ve already got your BandoTitleProvider handling meta titles, getting that same processed value into your H1 tag is straightforward—you just need to pull the final title in your Fluid layout or template. Here are the most reliable methods:

Method 1: Use the Fluid Page Title ViewHelper #

This is the cleanest approach, as it automatically leverages all registered title providers (including your custom one) to return the finalized page title. In your layout file (e.g., Resources/Private/Layouts/Default.html), replace your existing H1 code with:

<h1>{f:page.title()}</h1>

If your title includes HTML entities or formatted content, wrap it in f:format.raw to ensure proper rendering:

<h1><f:format.raw>{f:page.title()}</f:format.raw></h1>

Method 2: Access via TSFE Object (for PHP/advanced scenarios) #

TYPO3 updates the $TSFE->page['title'] value with the processed title from your provider. In Fluid, you can access this directly:

<h1>{TSFE.page.title}</h1>

Just double-check your TypoScript config to make sure your provider has priority over the default ones:

config.pageTitleProviders {
    bando {
        provider = Vendor\Extension\TitleProvider\BandoTitleProvider
        before = default  # Ensures your provider runs first and overrides defaults
    }
}

2. Prevent SQL Injection with DatabaseQueryProcessor #

Never directly insert user input (like GET parameters) into your SQL queries—always use parameter binding with DatabaseQueryProcessor to eliminate injection risks. Here’s how to safely query by the uid GET parameter:

Safe TypoScript Configuration #

10 = TYPO3\CMS\Frontend\DataProcessing\DatabaseQueryProcessor
10 {
    table = tx_your_extension_domain_model_yourmodel
    where = uid = :uid  # Use a named placeholder instead of raw input
    markers {
        uid.data = GP:tx_your_extension_plugin|uid  # Pull the GET parameter value
        uid.intval = 1  # Force conversion to integer—extra security layer for numeric IDs
    }
}

Key Security Practices: #

• Named Placeholders: The :uid placeholder tells TYPO3 to safely bind the value later, avoiding raw user input in the SQL string.
• Type Casting: Adding uid.intval = 1 ensures the input is treated as an integer (since uid is always numeric), blocking non-integer values entirely.
• Avoid String Interpolation: Never write where = uid = {GP:tx_your_extension_plugin|uid}—this directly injects user input into the query and is a critical security flaw.

For string parameters (e.g., search keywords), use parameter binding plus escaping:

markers {
    searchTerm.data = GP:tx_your_extension_plugin|search
    searchTerm.escapeSpecialChars = 1
    searchTerm.wrap = %|%  # Add wildcards safely before binding to the query
}

Then use where = title LIKE :searchTerm in your query to safely perform a partial match.

内容的提问来源于stack exchange，提问作者MarioProject