WooYun.org

private function checkOneWhere($str) {
		$tmp = preg_replace('/(["|\']).*?\\1/s', '', $str);
		$tmp = strtoupper($tmp);
		if (strstr($tmp, ' BETWEEN ')) $tmp = preg_replace('/ AND /', '', $tmp, 1);
		// 不是单个条件直接返回
		if (strstr($tmp, ' AND ') || strstr($tmp, ' OR ') || strstr($tmp, ' XOR ')) return $str;
		//主要是这里，发现AND OR XOR就会直接返回，而不会进过后面的parseValue()函数
		// 规范化IN
		$tmp = strtok($str, '"\'');
		if (stristr($tmp, ' IN(')) {
			$tmp = preg_replace('/ IN\(/i', ' IN (', $tmp, 1);
			$str = preg_replace('/ IN\(/i', ' IN (', $str, 1);
		}
		foreach(array('!=', '>=', '<=', '=', '>', '<', ' NOT IN ', ' IN ', ' NOT LIKE ', ' LIKE ', ' BETWEEN ') as $comp) {
			if (stristr($tmp, $comp)) {
				$t = explode($comp, $str, 2);
				$field = $this -> addSpecialChar($t[0]);
				$value = trim($t[1]);
				if (is_string($value)) {
					$first = substr($value, 0, 1);
					if ($first == '"' || $first == '\'') {
						$value = substr($value, 1, -1);
						if (!stristr($comp, ' IN ')) $value = $this -> parseValue($value);
					} else {
						if (!(stristr($comp, ' IN ') || (strpos($field, '.', 1) && strpos($value, '.', 1)))) {
							$value = $this -> parseValue($value);
						}
					}
				}
				return "$field $comp $value";
			}
		}
		return $str;
	}

import('Lib/Core/App', 'jxcms');
import('Lib/Core/Base', 'jxcms');
if (C('WEBSCAN', 1) && !defined('IN_ADMIN')) Webscan :: run();
只要是后台操作就不开启

public function login() {
		if ($this -> isSubmit) {
			if (C('captcha_admin_login', 0, 'member')) {
				$captcha = new Captcha();
				$captcha -> check(trim($_POST['captcha'])) or $this -> showMsg(L('CAPTCHA_ERROR'));
			}
			$memberObj = M('member');
			$username = trim($_POST['username']);		//未过滤
			$password = md5(trim($_POST['password']));
			$field = array('userid', 'username', 'password', 'email', 'lastdate', 'groupid');
			$where = array('username' => $username, 'groupid' => 1);
			$r = $memberObj -> field($field) -> where($where) -> find(); //where直接带入
			if ($r) {
				if ($r['password'] == $password) {
					// 后台登陆信息
					$loginInfo = array('userid' => $r['userid'], 'username' => $r['username'], 'email' => $r['email'], 'lastdate' => $r['lastdate'], 'groupid' => 1, 'role' => $memberObj -> getRole($r['userid']), 'hash' => Func :: getHash($username . $password));
					// 前台登陆信息
					$userInfo = array('userid' => $r['userid'], 'username' => $r['username'], 'email' => $r['email'], 'lastdate' => $r['lastdate'], 'groupid' => 1, 'password' => $password);
					M('member') -> setLogin($userInfo);
					$_SESSION[C('DB_PREFIX', 1) . 'loginInfo'] = serialize($loginInfo);
					$this -> showMsg(L('LOGIN_SUCCESS'), '?a=defaults');
				} else $this -> showMsg(L('PASSWORD_ERROR'), '?a=login');
			} else $this -> showMsg(L('USERNAME_IS_NOT_EXIST'), '?a=login');
		}
		$this -> display('login');
	}