WooYun.org

public function check_field_unique(){
		$field_name = strim($_REQUEST['field_name']);
		$field_data = strim($_REQUEST['field_data']);
		$data = array();
		$data['error'] = 0;
		$data['msg'] = '';
		$account_name = strim($_REQUEST['account_name']);
		$result_data = $GLOBALS['db']->getOne("SELECT id FROM ".DB_PREFIX."supplier_submit WHERE ".$field_name."='".$field_data."'");
		if($result_data>0){ //已经存在数据
			$data['error'] = 1;
			$data['msg'] = "数据已经存在!";
		}
		ajax_return($data);
	}

//过滤注入
function filter_injection(&$request)
{
	$pattern = "/(select[\s])|(insert[\s])|(update[\s])|(delete[\s])|(from[\s])|(where[\s])/i";
	foreach($request as $k=>$v)
	{
				if(preg_match($pattern,$k,$match))
				{
						die("SQL Injection denied!");
				}
		
				if(is_array($v))
				{					
					filter_injection($v);
				}
				else
				{					
					
					if(preg_match($pattern,$v,$match))
					{
						die("SQL Injection denied!");
					}					
				}
	}
	
}