WooYun.org

function index_action()


	{


		$this->public_action();


		$this->member_satic();


        $this->com_cache();


		$resume = $this->obj->DB_select_once("resume","`uid`='".$this->uid."'");


		$expect=$this->obj->DB_select_once("resume_expect","`id`='".$resume['def_job']."'");


		if($_GET['type']=="job")


		{


			$where="`job_post` in (".$expect['job_classid'].") and `status`<>'1' and `state`='1' and `sdate`<'".mktime()."' and `r_status`<>'2' and `edate`>'".mktime()."'";


		}elseif($_GET['type']=="city"){


			$where="`cityid`='".$expect['cityid']."' and `status`<>'1' and `state`='1' and `sdate`<'".mktime()."' and `r_status`<>'2' and `edate`>'".mktime()."'";


		}else{


			$where="`state`='1' and status<>'1' and `sdate`<'".mktime()."' and `r_status`<>'2' and `edate`>'".mktime()."'";


		}


		$rows=$this->obj->DB_select_all("company_job",$where." order by id desc limit 12","`name`,`id`,`salary`,`edu`,`edate`");

function saveexpect_action()


	{


		if($_POST['submit'])


		{


			$eid=(int)$_POST['eid'];


			unset($_POST['submit']);


			unset($_POST['eid']);


			unset($_POST['urlid']);


			$_POST['name'] = iconv("utf-8", "gbk", $_POST['name']);


			$where['id']=$eid;


			$where['uid']=$this->uid;


			$_POST['lastupdate']=time();


			if($eid=="")


			{


				$num=$this->obj->DB_select_num("resume_expect","`uid`='".$this->uid."'");


				var_dump($num);


				if($num>=$this->config['user_number'])


				{


					echo 1;die;


				}


				$_POST['uid']=$this->uid;


				$nid=$this->obj->insert_into("resume_expect",$_POST);


				if ($nid)


				{

function gpc2sql($str,$str2) {





	if(preg_match("/select|insert|update|delete|union|into|load_file|outfile/is", $str))


	{


		exit(safe_pape());


	}


	if(preg_match("/select|insert|update|delete|union|into|load_file|outfile/is", $str2))


	{


		exit(safe_pape());


	}





	$arr=array(" and "=>" an d "," or "=>" Ｏr ","%20"=>" ","select"=>"Ｓelect","update"=>"Ｕpdate","count"=>"Ｃount","chr"=>"Ｃhr","truncate"=>"Ｔruncate","union"=>"Ｕnion","delete"=>"Ｄelete","insert"=>"Ｉnsert","<"=>"&lt;",">"=>"&gt;","\""=>"&quot;","'"=>"&acute;","--"=>"- -");


	


	foreach($arr as $key=>$v){


    	$str = preg_replace('/'.$key.'/isU',$v,$str);


	}


	return $str;


}

sleep\s*?\\([\d\.]+?\\)

benchmark\s*?\\(\d+?|sleep\s*?\\([\d\.]+?\\)

如果我们想让服务器挂掉或者查询当前的数据库环境，很容易，我们可以很轻松的sleep或者获取当前运行的数据库信息了，这些不依赖select字符的事情我们都可以做了。

function com_action()


	{


		$this->job_cache();


		$row=$this->obj->DB_select_once("zhaopinhui","`id`='".(int)$_GET['id']."'");


		$this->yunset("row",$row);


		$where="`zid`='".(int)$_GET['id']."' and status='1'";


		var_dump($where);


		$urlarr["c"]=$_GET['c'];


		$urlarr["id"]=$_GET['id'];


		$urlarr["page"]="{{page}}";


		$pageurl=$this->url("index",$_GET['m'],$urlarr,"1");


		$rows=$this->get_page("zhaopinhui_com",$where."  order by id desc",$pageurl,"13");


		if(is_array($rows)){


			foreach($rows as $key=>$v){


				$rows[$key]['comname']=$this->obj->get_comname($v['uid']);


				$rows[$key]['job']=$this->obj->DB_select_all("company_job","id in (".$v['jobid'].") and `status`<>'1' and `r_status`<>'2'","name,id");


			}


		}

function zphcom_action()


	{


		if(!$this->uid || !$this->username || $_COOKIE['usertype']!=2 || $this->uid!=$_GET['uid'])


		{


			$arr['status']=0;


			$arr['content']=iconv("gbk","utf-8","您不是企业用户或者还没有登录,<a href='index.php?m=login&usertype=2'>请先登录</a>");


		}elseif(!$_GET['pid']){


			$arr['status']=0;


			$arr['content']=iconv("gbk","utf-8","你没有选择招聘会");


		}elseif(!$_GET['jobid']){


			$arr['status']=0;


			$arr['content']=iconv("gbk","utf-8","你还没有选择职位");


		}elseif(is_array($this->obj->DB_select_once("zhaopinhui_com","uid='".(int)$_GET['uid']."' and zid='".(int)$_GET['pid']."'"))){


			$arr['status']=0;


			$arr['content']=iconv("gbk","utf-8","您已经参与该招聘会");


		}else{


			$jobidarr=@explode(",",$_GET['jobid']);


			$array=array();


			foreach($jobidarr as $v){


				if(!in_array($v,$array)){


					$array[]=$v;


				}


			}


			$sql['uid']=$_GET['uid'];


			$sql['zid']=$_GET['pid'];


			$sql['jobid']=@implode(",",$array);


			$sql['ctime']=mktime();


			$sql['status']=0;


			$id=$this->obj->insert_into("zhaopinhui_com",$sql);