WooYun.org

/**
	 *  
	 * 提交订单
	 *
	 *
	 **/
	public function ordercomp() {
		
		$time = time();
		//判断订单执行条件
		//购物车
		$carts = $_SESSION["cart"]["list"];
		if(!$carts) {
			redirect(array("index","cart"));
		}
		//收货地址
		$addressid = intval($_POST["addressid"]); //整型过滤了，但是这个位置根据地址的id去取了用户的地址信息。
		$address = DB::getDB()->selectrow("user_address","*","uid=".$this->uid." AND addressid='$addressid'"); //获取地址信息
		if(!$address) cerror(__("error_address"));

$_SESSION['cart']['in'] = true;//正在执行订单
		$tradeid = $time . mt_rand(100,999);
		$data = array(
			"tradeid"			=> $tradeid,
			"uid"				=> $this->uid,
			"uname"				=> $_SESSION['uname'],
			"addtime"			=> $time,
			"status"			=> "WAIT_PAY",//未支付
			"totalfee"			=> getPrice($totalfee,2,'int'),
			"itemfee"			=> getPrice($itemfee,2,'int'),
			"postfee"			=> getPrice($postfee,2,'int'),
			"man"				=> $man ? $man['str'] : '',
			"coupon"			=> $coupon ? $coupon['deno'] : 0,
			"expresswayid"		=> $wayid,
			"posttype"			=> $posttype,
			"receiver_name"		=> $address['receiver'],   //使用了取出的$address变量插入了语句 ，下面几个点都是一样
			"receiver_province" => $address['province'],
			"receiver_city"		=> $address['city'],
			"receiver_district" => $address['district'],
			"receiver_address"  => $address['address'],
			"receiver_zip"	    => $address['zipcode'],
			"receiver_link"     => $address['link'],
			"memo"				=> $memo,
			"payment"			=> $paymentcode,
			"istax"				=> $istax,
			"tax_company"		=> $tax_company
		);
		DB::getDB()->insert("trade",$data);  //插入了sql语句中，导致了问题的发生。
		$adddata	= $promodata	= array();