WooYun.org

//批量修改执行
	case "info_do":
	
		//用户是否登录
		$userid = aac('user')->isLogin();
	
		$albumid = intval($_POST['albumid']);
		
		$albumface = tsClean($_POST['albumface']);//进行了过滤，但未过滤完全
		
		$arrPhotoId = intval($_POST['photoid']);
		$arrPhotoDesc = $_POST['photodesc'];
		
		if($TS_USER['user']['isadmin']==0){
		
			foreach($arrPhotoDesc as $key=>$item){
			
				//过滤内容开始
				aac('system')->antiWord($item);
				//过滤内容结束
			
			}
		}
		
		foreach($arrPhotoDesc as $key=>$item){
			if($item){
				$photoid = intval($arrPhotoId[$key]);
				
				$new['photo']->update('photo',array(
					'photoid'=>$photoid,
				),array(
				
					'photodesc'=>tsClean($item),
				
				));
			
			}
		}
	
		//更新相册封面
		if($albumface){
			$new['photo']->update('photo_album',array(
				'userid'=>$userid,
				'albumid'=>$albumid,
			),array(
				'albumface'=>$albumface,//带入数据库查询导致SQL注入
			));
		}
		
		header("Location: ".tsUrl('photo','album',array('id'=>$albumid)));
		
		break;

function tsClean($text) {
	$text = cleanJs ( $text );
	return $text;
}
/**
 * 过滤脚本代码
 * @param unknown $text
 * @return mixed
 */
function cleanJs($text) {
	$text = trim ( $text );
	$text = stripslashes ( $text );
	// 完全过滤注释
	$text = preg_replace ( '/<!--?.*-->/', '', $text );
	// 完全过滤动态代码
	$text = preg_replace ( '/<\?|\?>/', '', $text );
	// 完全过滤js
	$text = preg_replace ( '/<script?.*\/script>/', '', $text );
	// 过滤多余html
	$text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text );
	// 过滤on事件lang js
	while ( preg_match ( '/(<[^><]+)(lang|data|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) {
		$text = str_replace ( $mat [0], $mat [1], $text );
	}
	while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) {
		$text = str_replace ( $mat [0], $mat [1] . $mat [3], $text );
	}
	return $text;
}

public function update($table, $conditions, $row) {
		$where = "";
		if (empty ( $row ))
			return FALSE;
		if (is_array ( $conditions )) {
			$join = array ();
			foreach ( $conditions as $key => $condition ) {
				$condition = $this->escape ( $condition );
				$join [] = "{$key} = {$condition}";
			}
			$where = "WHERE " . join ( " AND ", $join );
		} else {
			if (null != $conditions)
				$where = "WHERE " . $conditions;
		}
		foreach ( $row as $key => $value ) {
			$vals [] = "`$key` = '$value'";
		}
		$values = join ( ", ", $vals );
		$sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}";
		
		return $this->db->query ( $sql );
	}