WooYun.org

<?php
//过滤GET或POST的值，去除两端空格和转义符号
if ($_SERVER['REQUEST_METHOD'] == 'POST'){
	check::filtrateData($_POST,$arrGPdoDB['htmlspecialchars']);
}elseif($_SERVER['REQUEST_METHOD'] == 'GET'){
	check::filtrateData($_GET,$arrGPdoDB['htmlspecialchars']);
}
?>

/cases/adminu/modifyinfo.php
/download/adminu/modifyinfo.php
/emailist/adminu/modifyinfo.php
/phonelist/adminu/modifyinfo.php
/product/adminu/modifyinfo.php

无关代码
$objWebInit = new cases();
//数据库连接参数
$objWebInit->setDBG($arrGPdoDB);
//smarty参数
$objWebInit->arrGSmarty = $arrGSmarty;
//图片上传参数
$objWebInit->arrGPic = $arrGPic;
$objWebInit->db();
// 取得文章信息
$arrInfo = $objWebInit->getInfo($_GET['id']);
if($arrInfo['user_id']!=$_SESSION['user_id']) check::AlertExit("错误：此信息不是您发布的，您无权修改!",-1);
无关代码

public function getInfo($intInfoID,$field = '*',$pass=null,$add=false){
		try {
			if($add) $this->updateClicktimes(" Where id =".$intInfoID);
			if($pass!=null) $where= " and pass='$pass'";
			else $where='';
			$strSQL = "SELECT $field FROM $this->tablename1 ".
			" Where id ='".$intInfoID."'".$where;
			$rs = $this->db->query($strSQL);
			$arrData = $rs->fetchall(PDO::FETCH_ASSOC);
			if(!empty($arrData[0]['structon_tb'])) $arrData = $this->loadTableFieldG($arrData);
			if($this->arrGPdoDB['PDO_DEBUG']) echo $strSQL.'<br><br>';
			return current($arrData);
		} catch (PDOException $e) {
		    echo 'Failed: ' . $e->getMessage().'<br><br>';
		}
	}