WooYun.org

public static function sql($str)  //过滤函数
	{
		if (!get_magic_quotes_gpc()){ //gpc off 就转义，把之前那个奇葩的漏洞补了
			//不使用主要是因为，先有mysql的连接
			//$str =  mysql_real_escape_string($str);
			$str = addslashes($str);
		}
		$str = preg_replace('/([^a-z]+)(select|insert|update|delete|union|into|load_file|outfile|tiny_)/i', ' $2', $str);  //这个过滤是可以绕过的
		return $str;
	}

/**@param $str 字符串
	* @return 字符串
	*@note 处理HTML编辑器的内容，主要是解决JavaScript的注入问题
	*/
	
	public static function text($str)
	{
		$config = HTMLPurifier_Config::createDefault();
	    $cache_dir=Tiny::getPath('cache')."/htmlpurifier/";
		if(!file_exists($cache_dir))
		{
			File::mkdir($cache_dir);
		}
		$config = HTMLPurifier_Config::createDefault();
		//配置 缓存目录
		$config->set('Cache.SerializerPath',$cache_dir); //设置cache目录
			
		//配置 允许flash
		$config->set('HTML.SafeEmbed',true);
		$config->set('HTML.SafeObject',true);
		$config->set('Output.FlashCompat',true);
		//$config->set('HTML.Allowed', 'p');
		//$config->set('AutoFormat.AutoParagraph', true);
		//$config->set('AutoFormat.RemoveEmpty', true);
		//允许<a>的target属性
		$def = $config->getHTMLDefinition(true);
		$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');
		
		$purifier = new HTMLPurifier($config);
		if (get_magic_quotes_gpc())$str = stripslashes($str); //漏洞发生的位置，如果开启了gpc，则反转义一次。
		$str = $purifier->purify($str);
	    return  $str;
	}

//搜索与分类的条件解析
    private function parseCondition()
    {
        $page = intval(Req::args("p"));
        $page_size = 36;
        $sort = Filter::int(Req::args("sort"));
        $sort = $sort==null?0:$sort;
        $cid = Filter::int(Req::args("cid"));
        $cid = $cid==null?0:$cid;
        $brand = Req::args("brand");
        $price = Req::args("price");
        $keyword = urldecode(Req::args('keyword'));
        $keyword = Filter::sql($keyword); //经过了sql
        $keyword = Filter::text($keyword); //但是经过text之后，\' => ' 又变回去了，成功闭合了下面的fndAll函数。
        //初始化数据
        $attrs = $specs = $spec_attr = $category_child = $spec_attr_selected = $selected = $has_category = $category = $current_category = array();
        $where = $spec_attr_where = $url = "";
        $condition_num = 0;
        $model = $this->model;
        //基本条件的建立
        //关于搜索的处理
        $action = strtolower(Req::args("act"));
        if($action=='search'){
            //关于类型的处理
            ////提取商品下的类型
            $seo_title = $seo_keywords = $keyword;
            $where = "name like '%$keyword%'";
                $rows = $model->table("goods")->fields("category_id,count(id) as num")->where($where)->group("category_id")->findAll(); //带入了这里进行查询
                $category_ids = "";
                $category_count = array();
                foreach ($rows as $row) {
                    $category_ids .= $row['category_id'].',';
                    $category_count[$row['category_id']] = $row['num'];
                }
                $category_ids = trim($category_ids,",");
                $has_category = array();
                $seo_description = '';
                if($category_ids){
                    $rows = $model->table("goods_category")->where("id in ($category_ids)")->findAll();
                    foreach ($rows as $row) {
                        $path = trim($row['path'],',');
                        $paths = explode(',', $path);
                        $root = 0;
                        if(is_array($paths)) $root = $paths[0];
                        $row['num'] = $category_count[$row['id']];
                        $has_category[$root][] = $row;
                        $seo_description .= $row['name'].',';
                    }
                }
            if($cid!=0){
                $where = "category_id=$cid and name like '%$keyword%'";
                $category = $model->table("goods_category as gc ")->join("left join goods_type as gt on gc.type_id = gt.id")->where("gc.id=$cid")->find();
                if($category){
                    $attrs = unserialize($category['attr']);
                    $specs = unserialize($category['spec']);
                    if($category['seo_title']!='') $seo_title = $category['seo_title'];
                    else $seo_title = $category['name'];
                    if($category['seo_keywords']!='') $seo_keywords = $category['seo_keywords'];
                    if($category['seo_description']!='') $seo_description = $category['seo_description'];
                }
            }
            
        //关于分类检索的处理
        }