WooYun.org

public function all() {
        $_Obj = M($this->objName);
        $categoryObj = M("category");
        $_Obj->pageSize = 20;
        $where = "1=1";
        $key = $_POST['key'];
        $cid = $_GET['cid'];
        if ($key != "") {
            $where .= " and id = '" . $key . "' or title like '%$key%'";
        }
        if (!empty($cid) && $cid != "") {
            $where .= " and classid = " . $cid;  //没处理存在注入
        }
        if ($_GET["type"] == "user") {
            $where .= " and uid = " . $_COOKIE['userId']; //没处理存在注入
        }
        if (isset($_GET['yz'])) {
        	$where .= " AND yz =".$_GET['yz'];      //没处理存在注入
        }
        if (isset($_GET['levels'])) {
        	$where .= " AND levels =".$_GET['levels'];//没处理存在注入
        }
        if (isset($_GET['special'])) {
        	$where .= " AND special =".$_GET['special'];//没处理存在注入
        }
        if (isset($_GET['top'])) {
        	$where .= " AND top =".$_GET['top']; //没处理存在注入
        }
        if (isset($_GET['flashpic'])) {
        	$where .= " AND flashpic =".$_GET['flashpic']; //没处理存在注入
        }
   		$_Obj->setSortId();
        $orderBy = $_GET['sortId']; //没处理存在注入
        $_Obj->isAdmin = 1;
        $_objAry = $_Obj->where($where)->orderby("id ".$orderBy)->getList();
        $pidSelectStr = $categoryObj->getTree($categoryObj, 2,false);
        $this->setValue("pidSelectStr", $pidSelectStr);
        $this->setValue("categoryObj", $categoryObj);
        $this->setValue("objAry", $_objAry);
        $this->setValue("Obj", $_Obj);
        $this->setValue("action", "list");
        $this->forward("user/pictureList.html");
    }