WooYun.org

在文件 carAction.class.php中：
public function getmallcar( )
    {
        $getmallcar = new MallcarAction( );
        $arr = $getmallcar->redcar( );
        $car = new Model( "produc" );
        $i = 0;
        foreach ( $arr as $key => $value )
        {
            $ids = ( "|", $key );
            $pro[$i] = $car->where( "id=".$ids[0] )->find( );
            $pram = $ids[1];
            if ( empty( $pram ) )
            {
                $pro[$i]['pram'] = "";
            }
            else
            {
                $pro[$i]['pram'] = $ids[1];
            }
            $pro[$i]['allprice'] = $pro[$i]['memprice'] * $value;
            $pro[$i]['num'] = $value;
            $i += 1;
        }
        return $pro;
    }