WooYun.org

//定义入口常量
define('IN_MEMBER', TRUE);
//初始化参数
$c  = isset($c)  ? $c : 'login';
$a  = isset($a)  ? $a : '';
$d  = isset($d)  ? $d : '';
$id = isset($id) ? intval($id) : 0;
......
//更新资料
else if($a == 'saveedit')
{
	
	//检测数据完整性
	if($password!=$repassword or $email=='')
	{
		header('location:?c=edit');
		exit();
	}
	//HTML转义变量
	$answer    = htmlspecialchars($answer);
	$cnname    = htmlspecialchars($cnname);
	$enname    = htmlspecialchars($enname);
	$cardnum   = htmlspecialchars($cardnum);
	$intro     = htmlspecialchars($intro);
	$email     = htmlspecialchars($email);
	$qqnum     = htmlspecialchars($qqnum);
	$mobile    = htmlspecialchars($mobile);
	$telephone = htmlspecialchars($telephone);
	$address   = htmlspecialchars($address);
	$zipcode   = htmlspecialchars($zipcode);
	//检测旧密码是否正确
	if($password != '')
	{
		$oldpassword = md5(md5($oldpassword));
		$r = $dosql->GetOne("SELECT `password` FROM `#@__member` WHERE `username`='$c_uname'");
		if($r['password'] != $oldpassword)
		{
			ShowMsg('抱歉，旧密码错误！','-1');
			exit();
		}
	}
	$sql = "UPDATE `#@__member` SET ";
	if($password != '')
	{
		$password = md5(md5($password));
		$sql .= "password='$password', ";
	}
	@$sql .= "question='$question', answer='$answer', cnname='$cnname', enname='$enname', sex='$sex', birthtype='$birthtype', birth_year='$birth_year', birth_month='$birth_month', birth_day='$birth_day', astro='$astro', bloodtype='$bloodtype', trade='$trade', live_prov='$live_prov', live_city='$live_city', live_country='$live_country', home_prov='$home_prov', home_city='$home_city', home_country='$home_country', cardtype='$cardtype', cardnum='$cardnum', intro='$intro', email='$email', qqnum='$qqnum', mobile='$mobile', telephone='$telephone', address_prov='$address_prov', address_city='$address_city', address_country='$address_country', address='$address', zipcode='$zipcode' WHERE id=$id";
	if($dosql->ExecNoneQuery($sql))
	{
		ShowMsg('资料更新成功！','?c=edit');
		exit();
	}