WooYun.org

$pattern_arr = $replace_arr = array();
if(!defined('IN_ADMIN')) {
    $pattern_arr = array(
        "/ union /i", "/\/\*\s?\*\/union\/\*\s?\*\//i",
        "/ select /i", "/\/\*\s?\*\/select\/\*\s?\*\//i",
        "/ update /i", "/\/\*\s?\*\/update\/\*\s?\*\//i",
        "/ from /i","/\/\*\s?\*\/from\/\*\s?\*\//i",
        "/ or /i","/\/\*\s?\*\/or\/\*\s?\*\//i",
        "/ and /i","/\/\*\s?\*\/and\/\*\s?\*\//i",
        "/ outfile /i", 
        "/\(\s?select\s+/i",
    );
    $replace_arr = array(
        ' union ', '/∗∗/union/∗∗/',
        ' select ', '/∗∗/select/∗∗/',
        ' update ', '/∗∗/update/∗∗/',
        ' from ', '/∗∗/from/∗∗/',
        ' outfile ', 
        ' or ', '/∗∗/or/∗∗/',
        ' and ', '/∗∗/and/∗∗/',
        '* from ',
        '(select ',
    );
    $_POST = strip_sql($_POST);
    $_GET = strip_sql($_GET);
    $_COOKIE = strip_sql($_COOKIE);
    unset($pattern_arr, $replace_arr);
}
define('MAGIC_QUOTES_GPC', get_magic_quotes_gpc());
if(!MAGIC_QUOTES_GPC) {
    $_POST = add_slashes($_POST);  //调用addslashes 转义
    $_GET = add_slashes($_GET);
    $_COOKIE = add_slashes($_COOKIE);
    $_FILES && $_FILES = add_slashes($_FILES);
}
if(!empty($_POST)) extract($_POST, EXTR_SKIP);  if(!empty($_GET)) extract($_GET, EXTR_SKIP);
$sort = $jssort=='shop' ? (isset($sort) && $sort > 0 && $sort <= 3 ? $sort : 0) : (isset($sort) && $sort > 0 && $sort <= 3 ? $sort : 0);
    $num = isset($num) && intval(trim($num)) >= 1 ? intval(trim($num)) : 10;
    $intercept = isset($intercept) && $intercept > 0 ? intval($intercept) : 0;
    $openwindow = isset($openwindow) && $openwindow > 0 ? 1 : 0;
    $pcdname = isset($pcdname) && $pcdname > 0 ? 1 : 0;
    if(!$sort) {
        exit("document.write(\"未选择显示类型。\");");
    }
    $cachename = 'js_'.md5($jssort.$panels.$sort.$num);
    $cachefile = MUDDER_CACHEDIR.'cache_'.$cachename.'.php';
    $where = '';
    if((@!include($cachefile)) || $timestamp - $_createtime_js > $cachelife) {
        $panels = $panels ? explode('_', $panels) : '';
        if($panels && is_array($panels)) foreach($panels as $panel) {
            $where .= ($where ? " OR " : " ")."classcode like '{$panel}__'";
        }