WooYun.org

public function filter_user()
    {
		$where   = '';
		$userIds = '';
    	$search  = IFilter::act(IReq::get('search')); //这里只对value作了过滤，而key没有过滤
    	foreach($search as $key => $val)
    	{
    		if($val)
    		{
    			$where .= $key.'"'.$val.'"';
    		}
    	}
    	//有筛选条件
    	if($where)
    	{
	    	$userDB = new IQuery('user as u');
	    	$userDB->join  = 'left join member as m on u.id = m.user_id';
	    	$userDB->fields= 'u.id';
	    	$userDB->where = $where;
	    	$userData      = $userDB->find();
	    	$tempArray     = array();
	    	foreach($userData as $key => $item)
	    	{
	    		$tempArray[] = $item['id'];
	    	}
	    	$userIds = join(',',$tempArray);
	    	if(!$userIds)
	    	{
	    		die('<script type="text/javascript">alert("没有找到用户信息,请重新输入条件");window.history.go(-1);</script>');
	    	}
    	}
    	die('<script type="text/javascript">parent.searchUserCallback("'.$userIds.'");</script>');
}

/**
	 * @brief 对字符串进行过滤处理
	 * @param  string $str      被过滤的字符串
	 * @param  string $type     过滤数据类型 值: int, float, string, text, bool, url
	 * @param  int    $limitLen 被输入的最大字符个数 , 默认不限制;
	 * @return string 被过滤后的字符串
	 * @note   默认执行的是string类型的过滤
	 */
	public static function act($str,$type = 'string',$limitLen = false)
	{
		if(is_array($str))
		{
			foreach($str as $key => $val)
			{
				$resultStr[$key] = self::act($val, $type, $limitLen);
			}
			return $resultStr;
		}
		else
		{
			switch($type)
			{
				case "int":
					return intval($str);
					break;
				case "float":
					return floatval($str);
					break;
				case "text":
					return self::text($str,$limitLen);
					break;
				case "bool":
					return (bool)$str;
					break;
				case "url":
					return self::clearUrl($str);
					break;
				case "filename":
					return self::fileName($str);
					break;
				default:
					return self::string($str,$limitLen);
					break;
			}
		}
	}