WooYun.org

case "admin_buy_point":
	{	
		if(!empty($_POST['points'])&&is_numeric($_POST['points'])) 
//如果points的参数不为整形，就进入下一个if语句，那么我们就改为字符型
		{
			$admin->buy_point($_POST['points']);
		}
		if($_GET['statu']==1) 
		{
			$admin->use_point($_GET['price']);
//有条件statu=1就进入了use_point函数，我们跟踪use_point函数
			msg("main.php?action=admin_buy_point");
		}	
		include_once("includes/point_inc.php");
		$tpl->assign("myrank",point_ranks($buid));
		@include_once("includes/point_inc.php");
		$tpl->assign("rates",$point_config['rmb_point']);
		$page= "admin_buy_point.htm";
		break;
	}
admin_class.php中
	function use_point($point)
	{
		global $buid;
		$t=time();
		$sql="update ".ALLUSER." set point=point+$point where userid=$buid";
//直接就把当前用户的积分就更新了
		$re=$this->db->query($sql);
		return $re;
	}

main.php文件中
	case "admin_adv_list":
	{	
		if(!empty($_GET['deid']))
			$db->query("delete from ".ADVSCON." where ID='$_GET[deid]'"); 
//和第一处一样，把deid只为空进入下一个if语句
		if(!empty($_GET['order_id']))
//把order_id的值加入url中，就把我们的订单更改为已经支付的了
			$db->query("update ".ADVSCON." set statu=1 where ID='$_GET[order_id]'"); //任意支付订单
			
		$db->query("select * from ".ADVSCON." where userid='$buid'");
		$tpl->assign("re",$re = $db->getRows());
		$page= "admin_adv_list.htm";
		break;
	}