WooYun.org

function ajax_arclist(){
$prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true;
		 //表过滤防止泄露信息,只允许的表
		 if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();}
		 if(!empty($_REQUEST['model'])){
		 if($prefix == true){
		 $model = C('DB_PREFIX').$_REQUEST['model'];
		 }
		 else{
		$model =	$_REQUEST['model'];
		 } 
		 }else{
		$model = C('DB_PREFIX').'article';
		 }  
         $order     =!empty($_REQUEST['order'])?inject_check($_REQUEST['order']):'';
         $num       =!empty($_REQUEST['num'])?inject_check($_REQUEST['num']):'';
         $where     =!empty($_REQUEST['where'])?inject_check(urldecode($_REQUEST['where'])):'';
         
         //使where支持 条件判断,添加不等于的判断
         $page=false;
         if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page'];    
         $pagesize  =!empty($_REQUEST['pagesize'])?intval($_REQUEST['pagesize']):'10';
         //$query     =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用
         $field     = '';
		 if(!empty($_REQUEST['field'])){
		 $f_t = explode(',',inject_check($_REQUEST['field']));
		 $f_t = array_map('urlencode',$f_t);
		 $field = implode(',',$f_t);
		 }
	
         $m=new Model($model,"",false);	 
         //如果使用了分页,缓存也不生效
         if($page){
               import("@.ORG.Page");     //这里改成你的Page类           
              $count=$m->where($where)->count();
              var_dump($count);exit();
              $total_page = ceil($count / $pagesize);
              $p = new Page($count,$pagesize);
               //如果使用了分页，num将不起作用
               $t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select();
			   //echo $m->getLastSql();			   
			   $ret = array('total_page'=>$total_page,'data'=>$t);			   
         }
         //如果没有使用分页，并且没有 query
         if(!$page){    
         $ret=$m->field($field)->where($where)->order($order)->limit($num)->select();
         }		 
         $this->ajaxReturn($ret,'返回信息',1);		 
}

$count=$m->where($where)->count();
               $t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select();
         $ret=$m->field($field)->where($where)->order($order)->limit($num)->select();