WooYun.org

case "do":
	
		$msg_userid = $userid;
		$msg_touserid = intval($_POST['touserid']);
		$msg_content = tsFilter($_POST['content']); //用tsFilter过滤
		
		aac('system')->antiWord($msg_content); //过滤垃圾词
		
		aac('message')->sendmsg($msg_userid,$msg_touserid,$msg_content);
               /×	
//发送消息
	public function sendmsg($userid,$touserid,$content){
	
		$userid = intval($userid);
		
		$touserid = intval($touserid);
		
		$content = str_replace(SITE_URL,'[SITE_URL]',$content);
		
		$content = addslashes(trim($content));
		
		if($touserid && $content){
		
			$messageid = $this->create('message',array(
				'userid'		=> $userid,
				'touserid'		=> $touserid,
				'content'		=> $content,
				'addtime'			=> time(),
			));
			
		}
	}
	
	
}
×/
		header("Location: ".tsUrl('message','my'));
		
		break;
}

function tsFilter($value) {
	$value = trim($value);
	//定义不允许提交的SQl命令和关键字
	$words = array();
	$words[] = "add ";
	$words[] = "and ";
	$words[] = "count ";
	$words[] = "order ";
	$words[] = "table ";
	$words[] = "by ";
	$words[] = "create ";
	$words[] = "delete ";
	$words[] = "drop ";
	$words[] = "from ";
	$words[] = "grant ";
	$words[] = "insert ";
	$words[] = "select ";
	$words[] = "truncate ";
	$words[] = "update ";
	$words[] = "use ";
	$words[] = "--";
	$words[] = "#";
	$words[] = "group_concat";
	$words[] = "column_name";
	$words[] = "information_schema.columns";
	$words[] = "table_schema";
	$words[] = "union ";
	$words[] = "where ";
	$words[] = "alert";
	$value = strtolower($value);
	//转换为小写
	foreach ($words as $word) {
		if (strstr($value, $word)) {
			$value = str_replace($word, '', $value);
		}
	}
	return $value;
}

<?php
defined('IN_TS') or die('Access Denied.');
$arrMsg = $new['message']->findAll('message',array(
	'touserid'=>$strUser['userid'],
	'isread'=>'0',
));
foreach($arrMsg as $key=>$item){  //可以看到没编码也没过滤
	$arrMsg[$key]['content'] = str_replace('[SITE_URL]',SITE_URL,$item['content']);
	if($item['userid']){
		$arrMsg[$key]['user'] = aac('user')->getOneUser($item['userid']);
	}
}
$title = '我的消息盒子';
include template("my");