WooYun.org

public function add_save(){
		$formid=safe_html($_GET['formid']);
		$form_arr=base::load_cache("cache_form","_form");
		$form=get_array($form_arr,'id',$formid,0);
		$fields=$_POST['fields']; //获取留言的内容，这里没有过滤
		$verifycode=$_POST['verifycode'];
		
		//验证码
		//if($form['0']['is_code']==1 && $verifycode!=$_SESSION['code']){
		//	showmsg(C('verifycode_error'),'-1');
		//}
		
		if(empty($fields['title'])||empty($formid)){
			showmsg(C('material_not_complete'),'-1');
		}
		$form=formtable($formid);
		if(empty($form)){
			showmsg(C('error'),'-1');
		}
		
		$table=$this->mysql->show_table();   //判断数据表是否存在
		if(!in_array(DB_PRE.$form,$table)){
			showmsg(C('table_not_exist'),'-1');
		}
		//添加附加表
		$sql_fields='`inputtime`';
		$sql_value=datetime();
		$send_text='留言内容：<br>';
		
                //问题就处在这，在处理留言内容时，过滤不严格可绕过，导致注入
		foreach($fields as $key=>$value){
			$sql_fields.=",`".safe_replace($key)."`";
			if(is_array($value)){
				$value_arr='';
				foreach($value as $k=>$v){
					$value_arr.=$v.',';
				}
				$value=$value_arr;
			}
			$sql_value.=",\"".safe_replace(safe_html($value))."\"";
			$send_text.=safe_replace(safe_html($value))."<br>";
		}
		$sql = "insert into ".DB_PRE.$form."({$sql_fields}) values ({$sql_value})";
		//echo $sql."\n";
		$this->mysql->query("insert into ".DB_PRE.$form."({$sql_fields}) values ({$sql_value})");
		$rs=$this->mysql->get_one("select * from ".DB_PRE."form where id=".$formid);
		if($rs['is_email']==1){
			sendmail('有人给您留言了！',$send_text);
		}
		showmsg(C('add_success'),'-1');
	}
}