WooYun.org

public function info_save()
    {
        $name = Filter::sql(Req::args("name"));
        $id = $this->user['id'];
        $this->model->table("user")->data(array("name"=>$name))->where("id=$id")->update();
        $this->model->table("customer")->where("user_id=$id")->update();
        $obj = $this->model->table("user as us")->join("left join customer as cu on us.id = cu.user_id")->fields("us.*,cu.group_id,cu.login_time")->where("us.id=$id")->find();
                    $this->safebox->set('user',$obj,$this->cookie_time);
        $this->redirect("info");
    }

$this->model->table("customer")->where("user_id=$id")->update();

public function update()
    {
        $sql = $this->sql;
        if(!is_array($sql['data']) || count($sql['data'])<1)
        {
            $sql['data'] = Req::post();
        }
        $set = '';
        foreach($sql['data'] as $key => $val)
        {
            if(is_string($key) && $key != $this->primary_key && isset($this->fields[$key]))
            {
                if(is_string($key))
                {
                    $value = $val;
                    if(is_null($val)){
                        $value = 'NULL';
                    }else{
                        $value = $this->formatField($this->fields[$key],$val);
                    }
                    if(is_scalar($value))
                    {
                        if(!is_array($val) && preg_match("/`$key`/i",trim($val))){
                            $set .= '`'.$key.'` = '.$val.',';
                        }
                        else  $set .= '`'.$key.'` = '.$value.',';
                    }
                }
            }
        }
        if($set!='')
        {
            $set = 'set '.trim($set,',');
            $this->fields($set);
            $this->changeWhere();
            $sql = $this->sql;
            $sqlStr = "update {$sql['table']} {$set} {$sql['where']}";
            return $this->query($sqlStr);
        }
    }

public static function post()
    {
        $num = func_num_args();
        $args = func_get_args();
        if($num==1)
        {
            if(isset( $_POST[$args[0]])){
                if(is_array( $_POST[$args[0]]))return  $_POST[$args[0]];
                else return trim( $_POST[$args[0]]);
            }
            return null;
        }
        else if($num>=2)
        {
            if($args[1]!==null)	$_POST[$args[0]] = $args[1];
            else if(isset($_POST[$args[0]])) unset($_POST[$args[0]]);
        }
        else
        {
            return $_POST;
        }
    }