php - curl query to backend, mix up data - php

Question

I'm not sure if this question was asked before, but I couldn't find anything.
When I CURL to the back-end from the front-end, I pass a JSON object containing a SQL query in base64:
base64(SELECT * FROM mytable) -> U0VMRUNUICogRlJPTSBteXRhYmxl
[{
'sql' : 'U0VMRUNUICogRlJPTSBteXRhYmxl'
}]
Back-end receives it, and then run that query over a sqlite3 database. It returns the data and put it into a JSON object:
[{
'column 1' : 'row 1 - data',
'column 2' : 'row 1 - data',
'column 3' : 'row 1 - data',
},{
'column 1' : 'row 2 - data',
'column 2' : 'row 2 - data',
'column 3' : 'row 2 - data',
},{
'column 1' : 'row 3 - data',
'column 2' : 'row 3 - data',
'column 3' : 'row 3 - data',
}]
and then returns it back with python flask server, I think with requests library.
My problem is that the JSON object that comes back doesn't look like the one above, but returns more like:
[{
'column 2' : 'row 1 - data',
'column 3' : 'row 1 - data',
'column 1' : 'row 1 - data',
},{
'column 2' : 'row 2 - data',
'column 3' : 'row 2 - data',
'column 1' : 'row 2 - data',
},{
'column 2' : 'row 3 - data',
'column 3' : 'row 3 - data',
'column 1' : 'row 3 - data',
}]
and I don't know why. I even tried to specify the SELECT statement as
SELECT "column 1", "column 2", "column 3" FROM mytable;
but still the same.
I can order it myself, but there isn't only 1 table to be queried.
My CURL code:
$query = $_POST['query'];
function safeQ($squery){
$denied = ["update","delete","insert","create","alter","drop"];
$squery = strtolower($squery);
foreach($denied as &$deny){
if (strpos($squery, $deny) !== false) {
return false;
}
}
return true;
}
print(getQuery($query));
function getQuery($query){
if (safeQ($query)){
$data->sql = base64_encode($query);
$jsonData = json_encode($data);
$ch = curl_init('https://www.example.com/api/sql_query');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonData);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($jsonData))
);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER, false);
$result = curl_exec($ch);
$httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
return $result;
}
}

Answer 1

To answer your question why, it is the same thing I said in the comments; when python is storing a dictionary, it does not care about order. Why the order turns out the way it does? That requires a more complicated knowledge of memory allocation that i'm currently capable of answering, but the point of using a key/value structure is not regarding the order the entries are in.
[{
'column 2' : 'row 1 - data',
'column 3' : 'row 1 - data',
'column 1' : 'row 1 - data',
},{
'column 2' : 'row 2 - data',
'column 3' : 'row 2 - data',
'column 1' : 'row 2 - data',
},{
'column 2' : 'row 3 - data',
'column 3' : 'row 3 - data',
'column 1' : 'row 3 - data',
}]
Is completely fine. If you start seeing this however;
[{
'column 2' : 'row 1 - data',
'column 3' : 'row 1 - data',
'column 1' : 'row 1 - data',
},{
'column 2' : 'row 3 - data',
'column 3' : 'row 3 - data',
'column 1' : 'row 3 - data',
},{
'column 2' : 'row 2 - data',
'column 3' : 'row 2 - data',
'column 1' : 'row 2 - data',
}]
It is a case for concern, since this time the array type structure got out of its original order.
You can make the following assertion yourself by opening an interpreter
>>> {'a':1,'b':2} == {'b':2,'a':1}
True