WooYun.org

$inQuery = "INSERT INTO `#@__member` (`mtype` ,`userid` ,`pwd` ,`uname` ,`sex` ,`rank` ,`money` ,`email` ,`scores` ,


        `matt`, `spacesta` ,`face`,`safequestion`,`safeanswer` ,`jointime` ,`joinip` ,`logintime` ,`loginip` )


       VALUES ('$mtype','$userid','$pwd','$uname','$sex','10','$dfmoney','$email','$dfscores',


       '0','$spaceSta','','$safequestion','$safeanswer','$jointime','$joinip','$logintime','$loginip'); "; //在此之前没有对$uname做判断，可注入单引号


        if($dsql->ExecuteNoneQuery($inQuery))

function RecordFeeds($type, $title, $note, $aid)


    {


        global $dsql,$cfg_mb_feedcheck;


        //确定是否需要记录


        if (in_array($type,array('add','addsoft','feedback','addfriends','stow'))){


            $ntime = time();


            $title = htmlspecialchars(cn_substrR($title,255));


            if(in_array($type,array('add','addsoft','feedback','stow')))


            {


                $rcdtype = array('add'=>' 成功发布了', 'addsoft'=>' 成功发布了软件',


                                 'feedback'=>' 评论了文章','stow'=>' 收藏了');


                //内容发布处理


                $arcrul = " <a href='/plus/view.php?aid=".$aid."'>".$title."</a>";


                $title = htmlspecialchars($rcdtype[$type].$arcrul, ENT_QUOTES);


            } else if ($type == 'addfriends')


            {


                //添加好友处理


                $arcrul = " <a href='/member/index.php?uid=".$aid."'>".$aid."</a>";


                $title = htmlspecialchars(' 与'. $arcrul."成为好友", ENT_QUOTES);


            }


            $note = Html2Text($note);


            $aid = (isset($aid) && is_numeric($aid) ? $aid : 0);


            $ischeck = ($cfg_mb_feedcheck == 'Y')? 0 : 1;


            $query = "INSERT INTO `#@__member_feed` (`mid`, `userid`, `uname`, `type`, `aid`, `dtime`,`title`, `note`, `ischeck`) 


                        Values('$this->M_ID', '$this->M_LoginID', '$this->M_UserName', '$type', '$aid', '$ntime', '$title', '$note', '$ischeck'); "; //插入用户动态，这里是重点，直接使用了$this->M_UserName


            $rs = $dsql->ExecuteNoneQuery($query);


            return $rs;


        } else {


            return FALSE;


        }