WooYun.org

case 'preview':
		$db->halt = 0;
		$destoon_task = '';
		if($tag_css) $tag_css = stripslashes($tag_css); 
		if($tag_html_s) $tag_html_s = stripslashes($tag_html_s); 
		if($tag_html_e) $tag_html_e = stripslashes($tag_html_e); 
		if($tag_code) $tag_code = stripslashes($tag_code); 
		if($tag_js) $tag_js = stripslashes($tag_js); 
		$code_eval = $code_call = $code_html = '';
		if($tag_css) $code_eval .= '<style type="text/css">'."\n".''.$tag_css.''."\n".'</style>'."\n";
		if($tag_html_s) $code_eval .= $tag_html_s."\n";
		$code_call = $code_eval;
		$code_call .= $tag_code."\n";
		$tag_code = str_replace('<!--{', '', $tag_code);
		$tag_code = str_replace('}-->', '', $tag_code);
		if(strpos($tag_code, '",') !== false) {
			$tag_code = str_replace(', '.$tag_expires.')', ', -1)', $tag_code);
		} else {
			$tag_code = str_replace('")', '", -1)', $tag_code);
		}
		$tag_code .= ';';
		ob_start();
		eval($tag_code);//eval直接执行1
		$contents = ob_get_contents();
		ob_clean();
		$code_eval .= $contents."\n";
		if($tag_html_e) {
			$code_eval .= $tag_html_e;
			$code_call .= $tag_html_e;
		}
		$t = str_replace('",', '&debug=1",', $tag_code);
		ob_start();
		eval($t);//eval直接执行2
		$td = ob_get_contents();
		ob_clean();