WooYun.org

public function indexAction() {
	    if ($this->post('ids')) { //刷新
	        $ids  = implode(',', $this->post('ids'));
			if (empty($ids)) $this->memberMsg(lang('m-con-6'));
			$this->content->update(array('updatetime'=>time()), "userid=" . $this->memberinfo['id'] . " and username='" . $this->memberinfo['username'] . "' and sysadd=0 and id in(" . $ids . ")");
	    }
.........

public static function post($string, $a=0) {
		$name = $a ? $string : (isset($_POST[$string]) ? $_POST[$string] : null);
		if (is_null($name)) return null;
		if (!is_array($name)) {
		    self::check_Post($string, $a);
		    return htmlspecialchars(trim($name));
		}
	    foreach ($name as $key=>$value) {
            $post_array[$key] = self::post($value, 1);
		}
		return $post_array;
	}

/**
	 * 记录$_POST中的非法字符
	 */
	public static function check_Post($var, $a=0) {
	    static $cfg = null;
	    $post = $a ? $var : (isset($_POST[$var]) ? $_POST[$var] : null);
		$cfg  = is_array($cfg) ? $cfg : self::load_config('attackcode');
		$bad  = $cfg['post'];
		if (empty($post) || empty($bad)) return null;
        foreach ($bad as $t) {
            if (substr_count(strtolower($post), $t) > 0) self::save_attack_log('POST', $post);
        }
	}

/**
 * GET和POST非法字符过滤配置（防非法字符攻击）
 */
 
return array(
    /*
	 * GET参数非法字符过滤
	 */
	 
    'get'  => array(
		'select ',
		'insert ',
		'\'',
		'/*',
		'*',
		'../',
		'..\\',
		'union ',
		'into ',
		'load_file(',
		'outfile ',
		'<script',
	),
	
	/*
	 * POST值非法字符过滤
	 */
	
		'post' => array(
		'<script',
		'<style',
		'<meta',
	)