WooYun.org

//上传
		$arrUpload = tsUpload($_FILES['Filedata'],$photoid,'photo',array('jpg','gif','png'));
		
		if($arrUpload){
			$new['photo']->update('photo',array(
				'photoid'=>$photoid,
			),array(
				'photoname'=>tsClean($arrUpload['name']),//没有过滤，导致SQL注入
				'phototype'=>tsClean($arrUpload['type']),
				'path'=>tsClean($arrUpload['path']),
				'photourl'=>tsClean($arrUpload['url']),
				'photosize'=>tsClean($arrUpload['size']),
			));
			
		}

function tsUpload($files, $projectid, $dir, $uptypes) {
	if ($files ['size'] > 0) {
		
		$menu2 = intval ( $projectid / 1000 );
		
		$menu1 = intval ( $menu2 / 1000 );
		
		$path = $menu1 . '/' . $menu2;
		
		$dest_dir = 'uploadfile/' . $dir . '/' . $path;
		
		createFolders ( $dest_dir );
		
		$arrType = explode ( '.', strtolower ( $files ['name'] ) ); // 转小写一下
		
		$type = array_pop ( $arrType );
		
		if (in_array ( $type, $uptypes )) {
			
			$name = $projectid . '.' . $type;
			
			$dest = $dest_dir . '/' . $name;
			
			// 先删除
			unlink ( $dest );
			// 后上传
			move_uploaded_file ( $files ['tmp_name'], mb_convert_encoding ( $dest, "gb2312", "UTF-8" ) );
			
			chmod ( $dest, 0777 );
			
			$filesize = filesize ( $dest );
			if (intval ( $filesize ) > 0) {
				return array (
						'name' => $files ['name'],
						'path' => $path,
						'url' => $path . '/' . $name,
						'type' => $type,
						'size' => $files ['size'] 
				);
			} else {
				return false;
			}
		} else {
			return false;
		}
	}
}

public function update($table, $conditions, $row) {
		$where = "";
		if (empty ( $row ))
			return FALSE;
		if (is_array ( $conditions )) {
			$join = array ();
			foreach ( $conditions as $key => $condition ) {
				$condition = $this->escape ( $condition );
				$join [] = "{$key} = {$condition}";
			}
			$where = "WHERE " . join ( " AND ", $join );
		} else {
			if (null != $conditions)
				$where = "WHERE " . $conditions;
		}
		foreach ( $row as $key => $value ) {
			$vals [] = "`$key` = '$value'";
		}
		$values = join ( ", ", $vals );
		$sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}";
		
		return $this->db->query ( $sql );
	}