WooYun.org

require('check.php');
if(empty($do)) $do= '';
$titstr="会员中心";     
$user_type=_getcookie('user_type');$ut='';
$user_type=='pmember'&&$ut='person';
$user_type=='cmember'&&$ut='company';
$user_type=='smember'&&$ut='school';
$user_type=='tmember'&&$ut='train';

<?php
/*
	[FRCMS] Copyright (c) 2010 Finereason.COM
	This is NOT a freeware, use is subject to license.txt
*/
defined('IN_FR') or exit('Access Denied');
!isset($db)&&$db=connectdb();
$goto=urlencode($_SERVER['REQUEST_URI']);
$username=_getcookie('user_login');
if($username==''){
    $str='';
    foreach($_POST as $key => $val){
		$str.="&$key=$val";
	}
	$goto=urlencode(joinchar($_SERVER['REQUEST_URI']).substr($str,1));
    echo "<script language=JavaScript>{location.href='{$cfg['path']}login.php?goto=$goto';}</script>";
    exit();
}else{
    $userpass=_getcookie('user_pass');
    $rs = $db->get_one("select m_id,m_flag,DATEDIFF(m_enddate,'".date('Y-m-d')."') as end,m_typeid,m_groupid,m_balance,m_integral,m_resumenums,m_mysendnums,m_mysendnum,m_myinterviewnums,m_myinterviewnum,m_myfavoritenums,m_myfavoritenum,m_letternums,m_contactnums,m_contactnum,m_expertnums,m_expertnum,m_recyclenums,m_recyclenum,m_hirenums,m_hirenum,m_hirenums,m_hirenum,m_smsnums,m_smsnum,m_operator,m_openid,m_mobileauth,m_emailauth,m_logo,m_confirm,m_logostatus from {$cfg['tb_pre']}member where m_login='$username' and m_pwd='$userpass' limit 0,1");

function _getcookie($var) {
	global $cfg;
	$var = $cfg['cookie_pre'].$var;
	return isset($_COOKIE[$var]) ? $_COOKIE[$var] : '';
}

function checksql($dbstr,$querytype='select'){
	$clean = '';
	$old_pos = 0;
	$pos = -1;
	//普通语句，直接过滤特殊语法
	if($querytype=='select'){
		$nastr = "/[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}/i";
		if(preg_match($nastr,$dbstr)){
            log_write($dbstr,'sql');
            showmsg('SafeError:10001', 'javascript:;');
            exit();
		}
	}
	//完整的SQL检查
	while (true){
		$pos = strpos($dbstr, '\'', $pos + 1);
		if ($pos === false){
			break;
		}
		$clean .= substr($dbstr, $old_pos, $pos - $old_pos);
		while (true){
			$pos1 = strpos($dbstr, '\'', $pos + 1);
			$pos2 = strpos($dbstr, '\\', $pos + 1);
			if ($pos1 === false){
				break;
			}
			elseif ($pos2 == false || $pos2 > $pos1){
				$pos = $pos1;
				break;
			}
			$pos = $pos2 + 1;
		}
		$clean .= '$s$';
		$old_pos = $pos + 1;
	}
	$clean .= substr($dbstr, $old_pos);
	$clean = trim(strtolower(preg_replace(array('~\s+~s' ), array(' '), $clean)));
	if (strpos($clean, 'union') !== false && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, '#') !== false){
		$fail = true;
	}
	elseif (strpos($clean, 'sleep') !== false && preg_match('~(^|[^a-z])sleep($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, 'benchmark') !== false && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, 'load_file') !== false && preg_match('~(^|[^a-z])load_file($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, 'into outfile') !== false && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (preg_match('~\([^)]*?select~s', $clean) != 0){
		$fail = true;
	}
	if (!empty($fail)){
        log_write($dbstr,'sql');
        showmsg('SafeError:10002', 'javascript:;');exit;
	}
	else
	{
		return $dbstr;
	}
}
?>