WooYun.org

public function model_add_save(){
		$modelname=safe_html($_POST['modelname']);//safe_html可被大写绕过
		$modeltable=$_POST['modeltable'];//未过滤，直接注入
		$modeltable_content=get_content_table($modeltable);
		$is_lock=$_POST['is_lock'];
		$is_fixed=$_POST['is_fixed'];
		if(empty($modelname)||empty($modeltable)){
			showmsg(C('material_not_complete'),'-1');
		}
		if(!check_str($modeltable,'/^[a-z0-9][a-z0-9]*$/')){
			showmsg(C('table').C('numbers_and_letters'),'-1');
		}
		$tables=$this->mysql->show_table();
		if(in_array(DB_PRE.$modeltable,$tables)){
			showmsg(C('table_exist'),'-1');
		}
		if(in_array(DB_PRE.$modeltable_content,$tables)){
			showmsg(C('table_exist'),'-1');
		}
		$this->mysql->db_insert('model',"`model_name`='".$modelname."',`model_table`='".$modeltable."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed);
		$field="`id` int(8) unsigned NOT NULL AUTO_INCREMENT,`catid` tinyint(5) unsigned NOT NULL DEFAULT '0',`title` char(80) NOT NULL,`thumb` char(100) NOT NULL,`keywords` char(40) NOT NULL,`description` char(255) NOT NULL,`commend` tinyint(1) unsigned NOT NULL DEFAULT '0',`url` char(100) NOT NULL,`userid` mediumint(8) unsigned NOT NULL DEFAULT '0',`username` char(20) NOT NULL,`inputtime` int(10) unsigned NOT NULL DEFAULT '0',`updatetime` int(10) unsigned NOT NULL DEFAULT '0',`hits` int(8) unsigned NOT NULL DEFAULT '0',`sort` int(8) unsigned NOT NULL DEFAULT '0',`style` char(20) default NULL,PRIMARY KEY (`id`)";
		$field_content="id int(8) not null,PRIMARY KEY (`id`)";
		$this->mysql->create_table($modeltable,$field);
		$this->mysql->create_table($modeltable_content,$field_content);
		$this->cache->model_cache();
		showmsg(C('add_success'),'-1');
	}

public function model_edit_save(){
		$id=isset($_POST['id'])?intval($_POST['id']):0;
		$modelname=safe_html($_POST['modelname']);//可大写绕过
		$is_lock=$_POST['is_lock'];
		$is_fixed=isset($_POST['is_fixed'])?intval($_POST['is_fixed']):1;
		if(empty($modelname)){
			showmsg(C('material_not_complete'),'-1');
		}
		$this->mysql->db_update("model","`model_name`='".$modelname."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed."","`id`=".$id);
		$this->cache->model_cache();
		showmsg(C('update_success'),'-1');
	}