WooYun.org

//编辑执行
        case "edo":
        
                if($_POST['token'] != $_SESSION['token']) {
                        tsNotice('非法操作！');
                }
        
                $afterid = intval($_POST['afterid']);
                
                $strAfter = $new['group']->find('group_topic_add',array(
                        'id'=>$afterid,
                ));
                
                if($strAfter['userid'] == $userid || $TS_USER['user']['isadmin']==1){
                
                        $content = tsClean($_POST['content']);
                        $title = tsClean($_POST['title']);
                        
                        //过滤内容开始
                        aac('system')->antiWord($title);
                        aac('system')->antiWord($content);
                        //过滤内容结束
                        
                        $new['group']->update('group_topic_add',array(
                                'id'=>$afterid,
                        ),array(
                                'title'=>$title,
                                'content'=>$content,
                                'uptime'=>time(),
                        ));

/**
 * 过滤脚本代码
 * @param unknown $text
 * @return mixed
 */
function cleanJs($text) {
        $text = trim ( $text );
        $text = stripslashes ( $text );
        // 完全过滤注释
        $text = preg_replace ( '/<!--?.*-->/', '', $text );
        // 完全过滤动态代码
        $text = preg_replace ( '/<\?|\?>/', '', $text );
        // 完全过滤js
        $text = preg_replace ( '/<script?.*\/script>/', '', $text );
        // 过滤多余html
        $text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text );
        // 过滤on事件lang js
        while ( preg_match ( '/(<[^><]+)(lang|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) {
                $text = str_replace ( $mat [0], $mat [1], $text );
        }
        while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) {
                $text = str_replace ( $mat [0], $mat [1] . $mat [3], $text );
        }
        return $text;
}
/**
 * 输入安全过滤
 * @param unknown $text
 * @return mixed
 */
function tsClean($text) {
        $text = cleanJs ( $text );
        return $text;
}

public function update($table, $conditions, $row) {
                $where = "";
                if (empty ( $row ))
                        return FALSE;
                if (is_array ( $conditions )) {
                        $join = array ();
                        foreach ( $conditions as $key => $condition ) {
                                $condition = $this->escape ( $condition );
                                $join [] = "{$key} = {$condition}";
                        }
                        $where = "WHERE " . join ( " AND ", $join );
                } else {
                        if (null != $conditions)
                                $where = "WHERE " . $conditions;
                }
                foreach ( $row as $key => $value ) {
                        $vals [] = "`$key` = '$value'";
                }
                $values = join ( ", ", $vals );
                $sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}";
                
                return $this->db->query ( $sql );
        }