WooYun.org

public function tenpay_return_url() { 
	
	    $partner = CS_Tenpay_ID;
        $key = CS_Tenpay_Key;
        require_once (CSCMSPATH."tenpay/ResponseHandler.class.php");
        $resHandler = new ResponseHandler();
        $resHandler->setKey($key);
	    //通知id
	    $notify_id = $this->input->get_post('notify_id', TRUE); 
	    //商户订单号
	    $out_trade_no = $this->input->get_post('out_trade_no', TRUE); 
	    //财付通订单号
	    $transaction_id = $this->input->get_post('transaction_id', TRUE); 
	    //如果有使用折扣券，discount有值，total_fee+discount=原请求的total_fee
	    $discount = $this->input->get_post('discount', TRUE); 
	    //支付结果
	    $trade_statess = $_GET['trade_state']; 
	    //交易模式,1即时到账
	    $trade_mode = $this->input->get_post('trade_mode', TRUE); 
        //判断签名
        if($resHandler->isTenpaySign()) {
	        if("1" == $trade_mode ) {
		        if( "0" == $trade_statess){ 
                                $row=$this->db->query("select CS_ID,CS_User,CS_RMB from ".CS_SqlPrefix."pay where CS_Dingdan='".$out_trade_no."'")->row();//这里是关注点
                                if(!$row){
                                        $this->CsdjSkins->Msg_url('验证失败,该定单不存在!',site_url('user')); 
                                }else{
                          		         //人民币转金币

function get_post($index = '', $xss_clean = FALSE)
	{
		if ( ! isset($_POST[$index]) )
		{
			return $this->get($index, $xss_clean);
		}
		else
		{
			return $this->post($index, $xss_clean);
		}
	}

public function xss_clean($str, $is_image = FALSE)
	{
		/*
		 * Is the string an array?
		 *
		 */
		if (is_array($str))
		{
			while (list($key) = each($str))
			{
				$str[$key] = $this->xss_clean($str[$key]);
			}
			return $str;
		}
		/*
		 * Remove Invisible Characters
		 */
		$str = remove_invisible_characters($str);
		// Validate Entities in URLs
		$str = $this->_validate_entities($str);
		/*
		 * URL Decode
		 *
		 * Just in case stuff like this is submitted:
		 *
		 * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
		 *
		 * Note: Use rawurldecode() so it does not remove plus signs
		 *
		 */
		$str = rawurldecode($str);//这里有一个decode的操作
		/*
		 * Convert character entities to ASCII
		 *
		 * This permits our tests below to work reliably.
		 * We only convert entities that are within tags since
		 * these are the ones that will pose security problems.
		 *
		 */
		$str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
		$str = preg_replace_callback("/<\w+.*?(?=>|<|$)/si", array($this, '_decode_entity'), $str);
		/*
		 * Remove Invisible Characters Again!
		 */
		$str = remove_invisible_characters($str);

//判断签名
        if($resHandler->isTenpaySign()) {