WooYun.org

$data = array();


      $_POST['content'] = unescape($_POST['content']);


      $data['aid'] = isset($_POST['aid']) ? intval($_POST['aid']) : exit(0);


      $data['tid'] = isset($_POST['tid']) ? intval($_POST['tid']) : 0;


      $data['content'] = isset($_POST['content']) ? $_POST['content'] : exit(0);


      $data['username'] = isset($_COOKIE['username']) ? $_COOKIE['username'] : '';


      //$data['userid'] = $admin->userid;


      $data['addtime'] = mktime();


      $data['ip'] = $_SERVER['REMOTE_ADDR'];


      $reply = db_bbs_reply::getInstance();


      $r = $reply->inserData($data);


      if($r){


      	  $archive = db_bbs_archive::getInstance();


          $archive->updateClickReply($data['aid'],'replynum');


......

function unescape($str) {


	$str = rawurldecode($str);


	preg_match_all("/%u.{4}|&#x.{4};|&#d+;|.+/U",$str,$r);


	$ar = $r[0];


	foreach($ar as $k=>$v){


		if(substr($v,0,2) == "%u"){


			$ar[$k] = iconv("UCS-2","UTF-8",pack("H4",substr($v,-4)));


		}elseif(substr($v,0,3) == "&#x"){


			$ar[$k] = iconv("UCS-2","UTF-8",pack("H4",substr($v,3,-1))); 


		}elseif(substr($v,0,2) == "&#"){


			$ar[$k] = iconv("UCS-2","UTF-8",pack("n",substr($v,2,-1)));


		}


	}


	return join("",$ar); 


}