WooYun.org

public function add_save(){
		$title=$_POST['title'];//注入点1
		$sort=intval($_POST['sort']);
		$is_show=$_POST['is_show'];//注入点2
		$groupid=$_POST['groupid'];//注入点3
		$url=$_POST['url'];//注入点4
		$parentid=isset($_POST['parentid'])?intval($_POST['parentid']):0;
		
		if(empty($title)){
			showmsg(C('material_not_complete'),'-1');
		}
		if(is_array($groupid)){
			$group_str=implode(',',$groupid);
		}
		
		$sql="insert into ".DB_PRE."menu (title,url,parentid,sort,is_show,groupid) values ('".$title."','".$url."','".$parentid."','".$sort."','".$is_show."','".$group_str."')";
		$this->mysql->query($sql);
		$this->menu_cache();
		showmsg(C('add_success'),'-1');
	}

public function edit_save(){
		$menuid=intval($_POST['menuid']);
		$title=$_POST['title'];//注入点5
		$sort=intval($_POST['sort']);
		$is_show=$_POST['is_show'];//注入点6
		$groupid=$_POST['groupid'];//注入点7
		$url=$_POST['url'];//注入点8
		$parentid=isset($_POST['parentid'])?intval($_POST['parentid']):0;
		
		if(empty($menuid)||empty($title)){
			showmsg(C('material_not_complete'),'-1');
		}
		if(is_array($groupid)){
			$group_str=implode(',',$groupid);
		}
		
		$this->mysql->db_update("menu","`title`='".$title."',`url`='".$url."',`sort`='".$sort."',`is_show`='".$is_show."',`groupid`='".$group_str."',`parentid`='".$parentid."'","`menuid`=".$menuid);
		$this->menu_cache();
		showmsg(C('update_success'),'index.php?m=xdcms&c=menu');
	}

public function sort_save(){
		$menuid=$_POST['menuid'];//注入点9
		foreach($menuid as $val){
			$sort=$_POST["sort{$val}"];
			if(is_numeric($sort)){
				$this->mysql->db_update("menu","`sort`='".$sort."'","`menuid`=".$val);
			}
		}
		$this->menu_cache();
		showmsg(C('update_success'),'index.php?m=xdcms&c=menu');
	}