WooYun.org

if(isset($_POST['edit'])){
	$db_host = isset($_POST['db_host']) ? trim($_POST['db_host']) : '';
	$db_user = isset($_POST['db_user']) ? trim($_POST['db_user']) : '';
	$db_pwd = isset($_POST['db_pwd']) ? trim($_POST['db_pwd']) : '';
	$db_name = isset($_POST['db_name']) ? trim($_POST['db_name']) : '';
	$db_prefix = isset($_POST['db_prefix']) ? trim($_POST['db_prefix']) : '';
	$user_name = isset($_POST['user_name']) ? trim($_POST['user_name']) : '';
	$sqm_num= isset($_POST['sqm_num']) ? trim($_POST['sqm_num']) : '';
	$password = isset($_POST['password']) ? trim($_POST['password']) : '';
	$repassword = isset($_POST['repassword']) ? trim($_POST['repassword']) : '';
	$conn = mysql_connect($_POST['db_host'],$_POST['db_user'],$_POST['db_pwd']);
	$conn_db = mysql_select_db($_POST['db_name'],$conn);
	if(!$conn){
		echo "数据库主机或数据库用户名或数据库密码错误!";exit;
	}elseif(!$conn_db){
		echo '数据库名称!';exit;
	}elseif($db_name == ''){
		echo '数据库不能为空!';exit;
	}elseif($db_prefix == ''){
		echo '数据库前缀不能为空!';exit;
	}elseif(!preg_match("/^[\w_]+_$/",$db_prefix)){
		echo '数据库前缀格式错误!';exit;
	}elseif($user_name == '' || $password == ''){
		echo '登录名和密码不能为空!';exit;
	}elseif(strlen($password) < 6){
		echo '登录密码不得小于6位';exit;
	}elseif($password!=$repassword){
		echo '两次输入的密码不一致';exit;
	}
	$config_file='../system/config/database.inc.php';	
	$con ="<?php\r\n\r\n";
	$con .= "return array(\r\n";
		$con .= "\t'default' => array (\r\n\t";
			$con .= "\t'hostname' => '".$db_host."',";
			$con .= "\r\n\t\t'database' => '".$db_name."',";                
			$con .= "\r\n\t\t'username' => '".$db_user."',";
			$con .= "\r\n\t\t'password' => '".$db_pwd."',";
			$con .= "\r\n\t\t'tablepre' => '".$db_prefix."',";
			$con .= "\r\n\t\t'charset' => 'utf8',";
			$con .= "\r\n\t\t'type' => 'mysql',";
			$con .= "\r\n\t\t'debug' => true,";
			$con .= "\r\n\t\t'pconnect' => 0,";
			$con .= "\r\n\t\t'autoconnect' => 0";
		$con .= "\r\n\t),";
	$con .= "\r\n);\r\n?>";
	file_put_contents($config_file,$con);	
	
	if(!empty($sqm_num)){		
		$sqm_file='../system/config/code.inc.php';
		$sqm="<?php return array('code'=>'$sqm_num'); ?>";
		file_put_contents($sqm_file,$sqm);		
	}
	
	$conn = @mysql_connect($_POST['db_host'],$_POST['db_user'],$_POST['db_pwd']);
			 mysql_select_db($_POST['db_name'],$conn);
	mysql_query("set names utf8");
	
	$sql = file_get_contents("install.sql");
	$sql = str_replace('DROP TABLE IF EXISTS `',"DROP TABLE IF EXISTS `".$_POST['db_prefix'],$sql);
	$sql = str_replace('CREATE TABLE `',"CREATE TABLE `".$_POST['db_prefix'],$sql);
	$sql = str_replace('INSERT INTO `',"INSERT INTO `".$_POST['db_prefix'],$sql);
	$sql = str_replace('IF EXISTS `',"IF EXISTS `".$_POST['db_prefix'],$sql);
	$array_sql = preg_split("/;[\r\n]/",$sql);
	$query_sql_g=true;
	echo "<h3 style='text-align:center; line-height:50px; font-weight:bold'><font color='#0c0'>正在安装中...请不要结束本页面！</font></h3><br/>";
	echo "<div style='text-align:center;width:100%'>";
	
	if(strlen(end($array_sql)) == 2){
					array_pop($array_sql);
    }
	$ik = 0;
	foreach($array_sql as $sql){
		$sql = trim($sql);		
		if (!empty($sql) && strlen($sql) != 2){
			$query_sql = mysql_query($sql,$conn);
			if(!$query_sql){
				if($ik%9==0){
					echo "<br/>";
				}
				echo $sql."<font color='red'>SQL 执行失败！</font>";$ik++;
			}else{
				if($ik%9==0){
					echo "<br/>";
				}
				echo "【SQL执行成功!】";$ik++;
			}
		}		
	}
	
	$password=md5(trim($password));
	$sql = "INSERT INTO `".$db_prefix."admin` (uid,mid,username,userpass) VALUES ('1','0','$user_name','$password')";
	$q = mysql_query($sql,$conn);
	if(!$q){
			
		echo $sql."<font color='red'>【添加管理员失败】</font>";$ik++;
	}else{
		echo "【添加管理员成功】";$ik++;
	}
	echo "</div>";
	
	if(!$query_sql_g){
		echo "<br/><h3 style='text-align:center; line-height:50px; font-weight:bold'><font color='red'>数据库安装失败,请清空数据库后重新安装！</font></h3><br/>";
	}else{
		echo "<br/><h3 style='text-align:center; line-height:50px; font-weight:bold'><a style='color:#f60' href='finish.php'>安装完成，点击进入！</a></h3><br/>";
	}
	exit;
}
if(file_exists("ok.lock")){
	echo "程序已经安装过";
	echo "<br>";
	echo "重新安装请删除,install 文件夹下的 <font color='red'>ok.lock</font> 文件";
	exit;
}

$config_file='../system/config/database.inc.php';	
	$con ="<?php\r\n\r\n";
	$con .= "return array(\r\n";
		$con .= "\t'default' => array (\r\n\t";
			$con .= "\t'hostname' => '".$db_host."',";
			$con .= "\r\n\t\t'database' => '".$db_name."',";                
			$con .= "\r\n\t\t'username' => '".$db_user."',";
			$con .= "\r\n\t\t'password' => '".$db_pwd."',";
			$con .= "\r\n\t\t'tablepre' => '".$db_prefix."',";
			$con .= "\r\n\t\t'charset' => 'utf8',";
			$con .= "\r\n\t\t'type' => 'mysql',";
			$con .= "\r\n\t\t'debug' => true,";
			$con .= "\r\n\t\t'pconnect' => 0,";
			$con .= "\r\n\t\t'autoconnect' => 0";
		$con .= "\r\n\t),";
	$con .= "\r\n);\r\n?>";
	file_put_contents($config_file,$con);

}elseif(!preg_match("/^[\w_]+_$/",$db_prefix)){
		echo '数据库前缀格式错误!';exit;