WooYun.org

function new_stripslashes($string)


{


    if(!is_array($string)) return stripslashes($string);


    foreach($string as $key => $val) $string[$key] = new_stripslashes($val);


    return $string;


}

require dirname(__FILE__).'/include/common.inc.php';


if(!$_userid) showmessage('禁止访问'); // 所以前提是我们注册个会员就ok了.


require_once CACHE_MODEL_PATH.'content_output.class.php';


require_once 'output.class.php';


if(!is_array($info)) showmessage('信息预览不能翻页');//这里将要带进来我们的危险参数了


$r = new_stripslashes($info);   //反转义了.....关键


$C = cache_read('category_'.$r['catid'].'.php');


$out = new content_output();


$r['userid'] = $_userid;


$r['inputtime'] = TIME;


$data = $out->get($r);


extract($data);


$userid = $_username;


for($i=1;$i<10;$i++)


{


    $str_attachmentArray[$i] = array("filepath" => "images/preview.gif","description" => "这里是图片的描述","thumb"=>"images/thumb_60_60_preview.gif");


}


        


$array_images = $str_attachmentArray;


$images_number = 10;


$allow_priv = $allow_readpoint = 1;


$updatetime = date('Y-m-d H:i:s',TIME);


        


$page = max(intval($page), 1);


$pages = $titles = '';


if(strpos($content, '[page]') !== false)  //这里必须还有这个[page]这个字符.....才能操作哈


{


    require_once 'url.class.php';


    $curl = new url();


    $contents = array_filter(explode('[page]', $content));


    $pagenumber = count($contents);


    for($i=1; $i<=$pagenumber; $i++)


    {


        $pageurls[$i] = $curl->show($r['contentid'], $i, $r['catid'], $r['inputtime']);//这里contentid进入SQL语句当中


    }

$pageurls[$i] = $curl->show($r['contentid'], $i, $r['catid'], $r['inputtime']);

function show($contentid, $page = 0, $catid = 0, $time = 0, $prefix = '')


    {


        global $PHPCMS;


        if($catid == 0 || $time == 0 || $prefix == '')


        {


            $r = $this->db->get_one("SELECT * FROM `".DB_PRE."content` WHERE `contentid`='$contentid'");


            if($r['isupgrade'] && !empty($r['url']))


            {