WooYun.org

api/remote/lastserver.ashx

<%@ WebHandler Language="C#" Class="com.xykj.remote.lastServer" %>
using System.Web;
using com.xykj.common;
using com.xykj.business;
using System.Text;
using System.Globalization;
namespace com.xykj.remote
{
    /// <summary>
    /// 最后登录的服务器
    /// </summary>
    public class lastServer : IHttpHandler
    {
        public void ProcessRequest(HttpContext context)
        {
            context.Response.HeaderEncoding = System.Text.Encoding.GetEncoding(RuntimeConstants.APP_CHARSET);
            context.Response.ContentType = "text/html";
            var para = sdk.Form(context.Request.Params); //先看下这个防注入函数
            var callback = para["callback"];
            var uid = para["uid"];
            var gid = para["gid"];
            var mygame = new com.xykj.business.View.Games.Game().LastServer(uid, gid); //这个要跟进
            sev t = new sev();
            if (mygame != null)
            {
                var servr = new com.xykj.business.View.Games.Server().GetServer((int)mygame.ServerId);
                t = new sev()
               {
                   Name = servr.Name,
                   GameId = mygame.GameId,
                   ServerId = mygame.ServerId,
                   UserId = mygame.UserId,
                   ID = mygame.ID,
                   LastJoin = mygame.LastJoin,
                   //Image = servr.Img1
               };
            }
            if (string.IsNullOrEmpty(callback))
            {
                context.Response.Write(XY.JToJson(t));
            }
            else
            {
                context.Response.Write(callback + "(" + XY.JToJson(t) + ")");
            }
        }
        public bool IsReusable { get { return false; } }
    }
    public class sev : com.xykj.model.xy_mygame
    {
        public string Name { get; set; }
        //public string Image { get; set; }
    }
}

public static NameValueCollection Form(NameValueCollection param)
{
    NameValueCollection values = new NameValueCollection();
    string str = "";
    foreach (string str2 in param.AllKeys)
    {
        str = "";
        str = param[str2].Replace("'", "&#39;").Replace("\"", "&quot;").Replace("<", "&lt;").Replace(">", "&gt;").Trim();
        values.Add(str2, str);
    } //对单引号进行转义了 如果值是int类型根本就不需要单引号
    return values;
}

public xy_mygame LastServer(string uid, string gid)
{
    IList<xy_mygame> list = this.GetDatas2<xy_mygame>("select top 1 * from xy_mygame where [UserId]=" + uid + " and [GameId]=" + gid + " order by id desc "); uid 和gid没有单引号保护 故存在注入 上面也没有对参数进行int强制性转换
    if (list.Count > 0)
    {
        return list[0];
    }
    return null;
}