WooYun.org

function m__save_order(){
    global $dbm;
    //判断登陆
    if(!isset($_SESSION['uid']) || !isset($_SESSION['uname'])) die('{"code":"100","msg":"你还没有登陆，请登入后再购买"}');
    $info_id = $_POST['info_id'];
    $info_title = urldecode($_POST['info_title']);
    $price = isset($_POST['price'])?$_POST['price']:0;
    $number = isset($_POST['number'])?$_POST['number']:0;
    if(!is_numeric($price)) die('{"code":"100","msg":"价格必须是数字"}');
    if(!is_numeric($number)) die('{"code":"100","msg":"数量必须是数字"}');
    if(intval($price)<=0) die('{"code":"120","msg":"购买数量不能少于1"}');
    if(strlen($_POST['rev_user'])<2) die('{"code":"100","msg":"收货人姓名必须填写"}');
    if(strlen($_POST['rev_addr'])<6) die('{"code":"100","msg":"收货人地址必须填写"}');
    if(strlen($_POST['rev_phone'])<8) die('{"code":"100","msg":"收货人手机必须填写"}');
    $params['order_content'] = '';
    $params['pay_total'] = 0;
    
    $params['order_content'] .= $price."元 x ".$number."";
    $params['pay_total'] += $number*$price;
    //订单数据
    $params['uid'] = isset($_SESSION['uid']) ? $_SESSION['uid'] : 0;
    $params['uname'] = isset($_SESSION['uname']) ? $_SESSION['uname'] : '';
    $params['info_title'] = $info_title;
    $params['info_id'] = $info_id;
    $params['order_receive'] = preg_replace('~<[^>]*>~','','收货人：'.$_POST['rev_user'].chr(10).'手机：'.$_POST['rev_phone'].chr(10).'收货地址：'.$_POST['rev_addr']);
    $params['create_time'] = time();//die(print_r($params));
    //入库
    if(isset($_SESSION['postdata']['gov_order']) && (time()-$_SESSION['postdata']['gov_order']<30)) die('{"code":"101","msg":"请不要重复提交订单"}');
	
	$res = $dbm->single_insert(TB_PREFIX."order",$params);

public function single_insert($table_name, $fields, $type = 0) {
        if (!is_array($fields) || count($fields) == 0) return array('sql' => '', 'error' => '插入失败，插入字段为空', 'sql_time' => 0, 'autoid' => 0);
        $sql_field = "";
        $sql_value = ""; 
        // 遍历字段和值
        foreach($fields as $key => $value) {
            $sql_field .= ",$key";
            $sql_value .= ",'$value'";
        } 
        $sql_field = substr($sql_field, 1);
        $sql_value = substr($sql_value, 1);
        if ($type == 0) {
            $sql = "insert ignore  into $table_name ($sql_field) values ($sql_value)"; //组合SQL
        } else {
            $sql = "replace into $table_name ($sql_field) values ($sql_value)"; //组合SQL
        } 
		echo $sql;
		exit;
        $result = $this -> query_insert($sql);