WooYun.org

if($groupid > 5) {
			if(strlen($member['company']) < 2) return $this->_($L['member_company_null']);
			if(preg_match("/[0-9]+/", $member['company'])) return $this->_($L['member_company_bad']); //这里 判断是不是数字 是数字就判断结束 .
			if($this->company_exists($member['company'])) return $this->_($L['member_company_reg']);
			if(strlen($member['type']) < 2) return $this->_($L['member_type_null']);
			if(strlen($member['telephone']) < 6) return $this->_($L['member_telephone_null']);
		}

$user = $do->get_one(); //这里先把查出来  在赋值到$post去 （防止有先变量被修改） 
因为公司名称 是可以控制的 我们输入注册的时候 输入 \ 让他转义掉后面的单引号
if($submit) {
	if($post['password'] && $user['password'] != md5(md5($post['oldpassword']))) message($L['error_password']);
	if($post['payword'] && $user['payword'] != md5(md5($post['oldpayword']))) message($L['error_payword']);
	$post['groupid'] = $user['groupid'];
	$post['email'] = $user['email'];
	$post['passport'] = $user['passport'];
	$post['company'] = $user['company']; //在这里
	$post['domain'] = $user['domain'];
	$post['icp'] = $user['icp'];
	$post['skin'] = $user['skin'];
	$post['template'] = $user['template'];
	$post['edittime'] = $DT_TIME;
	$post['bank'] = $user['bank'];
	$post['account'] = $user['account'];
	$post['validated'] = $user['validated'];
	$post['validator'] = $user['validator'];
	$post['validtime'] = $user['validtime'];
	$post['vemail'] = $user['vemail'];
	$post['vmobile'] = $user['vmobile'];
	$post['vtruename'] = $user['vtruename'];
	$post['vbank'] = $user['vbank'];
	$post['vcompany'] = $user['vcompany'];
	$post['vtrade'] = $user['vtrade'];
	$post['trade'] = $user['trade'];
	$post['support'] = $user['support'];
	$post['inviter'] = $user['inviter'];
	if($post['vmobile']) $post['mobile'] = $user['mobile'];
	if($post['vtruename']) $post['truename'] = $user['truename'];
	if($do->edit($post)) {  //进入修改查询流程 我们进去看看

function edit($member)	{
		if(!$this->is_member($member)) return false; 
		$member = $this->set_member($member);
		$r = $this->get_one();
		$member['linkurl'] = userurl($r['username'], '', $member['domain']);
		$member_fields = array('company','passport','sound','email','msn','qq','ali','skype','gender','truename','mobile','department','career','groupid','areaid', 'edittime','black','bank','account','vemail','vmobile','vbank','vtruename','vcompany','vtrade','trade','support','inviter'); //会员列
		$company_fields = array('company','type','areaid', 'catid','catids','business','mode','regyear','regunit','capital','size','address','postcode','telephone','fax','mail','homepage','sell','buy','introduce','thumb','keyword','linkurl','groupid','domain','icp','validated','validator','validtime','skin','template');//公司列
		$member_sql = $company_sql = '';
		foreach($member as $k=>$v) {
			if(in_array($k, $member_fields)) $member_sql .= ",$k='$v'"; //遍历数据 有符合的就连接起来 
			if(in_array($k, $company_fields)) $company_sql .= ",$k='$v'"; //遍历数据 有符合的就连接起来 
		}
		if($member['password']) {
			$password = md5(md5($member['password']));
			$member_sql .= ",password='$password'";
		}
		if($member['payword']) {
			$payword = md5(md5($member['payword']));
			$member_sql .= ",payword='$payword'";
		}
        $member_sql = substr($member_sql, 1);
        $company_sql = substr($company_sql, 1);
	    $this->db->query("UPDATE {$this->table_member} SET $member_sql WHERE userid=$this->userid");//进入查询
	     $this->db->query("UPDATE {$this->table_company} SET $company_sql WHERE userid=$this->userid");//进入查询
		$content_table = content_table(4, $this->userid, is_file(DT_CACHE.'/4.part'), $this->table_company_data);
	    $this->db->query("UPDATE {$content_table} SET content='$member[content]' WHERE userid=$this->userid");
		$member['userid'] = $this->userid;
		$member['vip'] = $r['vip'];
		userclean($member['username']);
		return true;
	}