由于微信公众号推送机制改变了,快来星标不再迷路,谢谢大家!
死学没用,劳逸结合,玩累了再学。
不经过任何过滤,张口就来,反射XSS
<?php if ($_GET['art']): ?><dd><span class="state">内容生成完毕 !共 <?php echo $_GET['art']; ?>条。</span></dd>
public function update(){if(isset($_POST['send'])){$this->_model->id=$_POST['id'];$this->getPost();if($this->_model->update_link()){tool::layer_alert('链接修改成功!','?a=link',6);}else{tool::layer_alert('链接修改失败!','?a=link',5);}}if(isset($_GET['id'])){$this->_model->id=$_GET['id'];$_link=$this->_model->get_linkOne();if($_link){$this->_tpl->assign('id',StripSlashes($_link[0]->id));$this->_tpl->assign('linkname',StripSlashes($_link[0]->linkname));$this->_tpl->assign('linkurl',StripSlashes($_link[0]->linkurl));$this->_tpl->assign('prev_url',tool::getPrevPage());}}$this->_tpl->display('admin/link/update.tpl');}
麻了
//表单提交字符转义static public function setFormString($_string) {if (!get_magic_quotes_gpc()) {if (Validate::isArray($_string)) {foreach ($_string as $_key=>$_value) {$_string[$_key] = self::setFormString($_value); //不支持就用代替addslashes();}} else {return addslashes($_string); //mysql_real_escape_string($_string, $_link);}}return $_string;}//转义过滤static public function setRequest() {if (isset($_GET)) $_GET = Tool::setFormString($_GET);if (isset($_POST)) $_POST = Tool::setFormString($_POST);}//反转义static public function getFormString($_object,$_field){if ($_object) {foreach ($_object as $_value) {$_value->$_field = StripSlashes($_value->$_field);}}}
class LogoUpload {private $error; //错误代码private $maxsize; //表单最大值private $type; //类型private $typeArr = array('image/png','image/x-png'); //类型合集private $path; //目录路径private $name; //文件名private $tmp; //临时文件private $linkpath; //链接路径//构造方法,初始化public function __construct($_file,$_maxsize) {$this->error = $_FILES[$_file]['error'];$this->maxsize = $_maxsize / 1024;$this->type = $_FILES[$_file]['type'];$this->path = ROOT_PATH.'/'.UPLOGO;$this->name = $_FILES[$_file]['name'];$this->tmp = $_FILES[$_file]['tmp_name'];$this->checkError();$this->checkType();$this->checkPath();$this->moveUpload();}private function checkType() {if (!in_array($this->type,$this->typeArr)) {Tool::alertBack('警告:LOGO图片必须是PNG格式!');}}
public function delall(){if(isset($_POST['send'])){if(validate::isNullString($_POST['pid'])) tool::layer_alert('没有选择任何图片!','?a=pic',7);$_fileDir=ROOT_PATH.'/uploads/';foreach($_POST['pid'] as $_value){$_filePath=$_fileDir.$_value;if(!unlink($_filePath)){tool::layer_alert('图片删除失败,请设权限为777!','?a=pic',7);}else{header('Location:?a=pic');}}
在C盘根目录新建/etc/passwd.txt文件
没了
★
欢 迎 加 入 星 球 !
代码审计+免杀+渗透学习资源+各种资料文档+各种工具+付费会员
进成员内部群
星球的最近主题和星球内部工具一些展示
加入安全交流群
关 注 有 礼
还在等什么?赶紧点击下方名片关注学习吧!
推荐阅读