WooYun.org

function job(){


		if($_GET['p_uid']){


			$data['p_uid']=(int)$_GET['p_uid'];


			$data['inputtime']=mktime();


			$data['c_uid']=$this->uid;


			$data['usertype']=$_COOKIE['usertype'];


			$haves=$this->obj->DB_select_once("blacklist","`p_uid`=".$data['c_uid']."  and `c_uid`=".$data['c_uid']." and `usertype`=".$data['usertype']."");


			if(is_array($haves)){


				$this->obj->layer_msg("该用户已在您黑名单中！",8,0,$_SERVER['HTTP_REFERER']);


			}else{


				$nid=$this->obj->insert_into("blacklist",$data);


				$num=$this->obj->DB_select_num("userid_job","`uid`=".$data['p_uid']."  and `com_id`=".$data['c_uid']."");


				$this->obj->DB_delete_all("userid_job","`uid`=".$data['p_uid']."  and `com_id`=".$data['c_uid'].""," ");


				$this->obj->DB_update_all("member_statis","`sq_jobnum`=`sq_jobnum`-$num","`uid`='".$data['p_uid']."'");


				$nid?$this->layer_msg('删除成功！',9,0,$_SERVER['HTTP_REFERER']):$this->layer_msg('删除失败！',8,0,$_SERVER['HTTP_REFERER']);


			}


		}

function DB_select_once($tablename, $where = 1, $select = "*") {


		$cachename=$tablename.$where;


		if(!$return=$this->Memcache_set($cachename)){


			$SQL = "SELECT $select FROM " . $this->def . $tablename . " WHERE $where limit 1";


			$query = $this->db->query($SQL);


			$return=$this->db->fetch_array($query);


			$this->Memcache_set($cachename,$return);


		}


		return $return;


	}

function job(){


......


if($_GET['r_uid']){


			if($_GET['r_reason']=="")


			{


				$this->obj->ACT_layer_msg("举报内容不能为空！",8,"index.php?c=down");


			}


			$data['p_uid']=(int)$_GET['r_uid'];


			$data['inputtime']=mktime();


			$data['c_uid']=$this->uid;


			$data['eid']=$_GET['eid'];


			$data['r_name']=$_GET['r_name'];


			$data['usertype']=$_COOKIE['usertype'];


			$data['username']=$this->username;


			$data['r_reason']=$_GET['r_reason'];


			$haves=$this->obj->DB_select_once("report","`p_uid`=".$data['p_uid']." and `c_uid`=".$data['c_uid']." and `usertype`=".$data['usertype']."","id");


			if(is_array($haves))


			{


				$this->obj->ACT_layer_msg("您已经举报过该用户！",8,"index.php?c=down");


			}else{


				$nid=$this->obj->insert_into("report",$data);


 				$nid?$this->obj->ACT_layer_msg("操作成功！",9,"index.php?c=down"):$this->obj->ACT_layer_msg("操作失败！",8,"index.php?c=down");


			}


		}

function gpc2sql($str) {





	if(preg_match("/select|insert|update|delete|union|into|load_file|outfile/is", $str))


	{


		exit(safe_pape());


	}


	$arr=array(" and "=>" an d "," or "=>" Ｏr ","%20"=>"","select"=>"Ｓelect","update"=>"Ｕpdate","count"=>"Ｃount","chr"=>"Ｃhr","truncate"=>"Ｔruncate","union"=>"Ｕnion","delete"=>"Ｄelete","insert"=>"Ｉnsert");


	foreach($arr as $key=>$v){


    	$str = preg_replace('/'.$key.'/isU',$v,$str);


	}


	return $str;


}


function safesql($StrFiltKey,$StrFiltValue,$type){


	


	 $getfilter = "\\<.+javascript:window\\[.{1}\\\\x|<.*=(&#\\d+?;?)+?>|<.*(data|src)=data:text\\/html.*>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\\(\d+?|sleep\s*?\\([\d\.]+?\\)|load_file\s*?\\()|<[a-z]+?\\b[^>]*?\\bon([a-z]{4,})\s*?=|^\\+\\/v(8|9)|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT(\\(.+\\)|\\s+?.+?)|UPDATE(\\(.+\\)|\\s+?.+?)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)(\\(.+\\)|\\s+?.+?\\s+?)FROM(\\(.+\\)|\\s+?.+?)|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";





	$postfilter = "<.*=(&#\\d+?;?)+?>|<.*data=data:text\\/html.*>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\\(\d+?|sleep\s*?\\([\d\.]+?\\)|load_file\s*?\\()|<[^>]*?\\b(onerror|onmousemove|onload|onclick|onmouseover)\\b|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT(\\(.+\\)|\\s+?.+?)|UPDATE(\\(.+\\)|\\s+?.+?)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)(\\(.+\\)|\\s+?.+?\\s+?)FROM(\\(.+\\)|\\s+?.+?)|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";





	$cookiefilter = "benchmark\s*?\\(\d+?|sleep\s*?\\([\d\.]+?\\)|load_file\s*?\\(|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT(\\(.+\\)|\\s+?.+?)|UPDATE(\\(.+\\)|\\s+?.+?)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)(\\(.+\\)|\\s+?.+?\\s+?)FROM(\\(.+\\)|\\s+?.+?)|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";