WooYun.org

/*
 * added by mody
 * glocal register
 */
//print '-----------global register----------<br>';
foreach(array('_COOKIE', '_POST', '_GET') as $_request) {
	foreach($$_request as $_key => $_value) {
		$_key{0} != '_' && $$_key = daddslashes($_value,0,0,1);
		/*
		if(is_array($$_key)){
			print '$'.$_key.'=';
			print_r($$_key);
			print '<br>';
		}
		else print '$'.$_key.'='.$$_key.';<br>';
		*/
	}
}
//print '-----------------------------------<br>';

/*POST变量转换*/
function daddslashes($string, $force = 0 ,$sql_injection =0,$url =0){
	!defined('MAGIC_QUOTES_GPC') && define('MAGIC_QUOTES_GPC', get_magic_quotes_gpc());
	if(!MAGIC_QUOTES_GPC || $force) {
		if(is_array($string)) {
			foreach($string as $key => $val) {
				$string[$key] = daddslashes($val, $force);
			}
		} else {
			$string = addslashes($string);
		}
	}
	if(is_array($string)){
		if($url){
			//$string='';
			foreach($string as $key => $val) {
				$string[$key] = daddslashes($val, $force);
			}
		}else{
			foreach($string as $key => $val) {
				$string[$key] = daddslashes($val, $force);
			}
		}
	}else{
		if(SQL_DETECT!=1 || $sql_injection==1){
			$string = str_ireplace("\"","/",$string);
			$string = str_ireplace("'","/",$string);
			$string = str_ireplace("*","/",$string);
			$string = str_ireplace("~","/",$string);
			$string = str_ireplace("select", "\sel\ect", $string);
			$string = str_ireplace("insert", "\ins\ert", $string);
			$string = str_ireplace("update", "\up\date", $string);
			$string = str_ireplace("delete", "\de\lete", $string);
			$string = str_ireplace("union", "\un\ion", $string);
			$string = str_ireplace("into", "\in\to", $string);
			$string = str_ireplace("load_file", "\load\_\file", $string);
			$string = str_ireplace("outfile", "\out\file", $string);
			$string = str_ireplace("sleep", "\sle\ep", $string);
			$string_html=$string;
			$string = strip_tags($string);
			if($string_html!=$string){
				$string='';
			}
			$string = str_replace("%", "\%", $string);     //   
		}
	}
	return $string;
}

<?php
# MetInfo Enterprise Content Management System 
# Copyright (C) MetInfo Co.,Ltd (http://www.metinfo.cn). All rights reserved. 
	ob_start();
	$depth='../';
	require_once $depth.'../include/common.inc.php';
	ob_clean();
	ob_start();

foreach($settings_arr as $key=>$val){
		if($val['columnid']==$class1){
			$tingname    =$val['name'].'_'.$val['columnid'];   //这里导致变量名必须含有下划线的都可以被覆盖
			$$val['name']=$$tingname;
		}
	}

$query = "SELECT * FROM $met_parameter where module=8 and lang='$lang' order by no_order"; 
         //>>>>注意，$met_parameter是在$settings_arr后被初始化的，不能直接覆盖，但是可以结合上面的危险操作，进行覆盖<<<<
	//print $query.'<br>';
	//die();
	$result = $db->query($query);
	while($list= $db->fetch_array($result)){
		/*
		print '<br><br>$list=';
		print_r($list);
		*/
		$feedbackpara[$list['id']]=$list;  // 注意这里的id
		$feedback_para[]=$list;
	}