任意sql语句执行 case 'list': $totalNum = $mysql->numTable("member", $where); $pageNum = 20; $totalPage = intval($totalNum/$pageNum) == $totalNum/$pageNum ? $totalNum/$pageNum : intval($totalNum/$pageNum)+1; $page = $page ? $page : 1; $page = $page>$totalPage ? $totalPage : $page; $page = $page<1 ? 1 : $page; $members = $mysql->select("member","id,name,time,money,provience,city,picture",$where,array("id DESC"),array(($page-1)*$pageNum,$pageNum)); www.2cto.com require(INCLUDE_PATH."page.class.php"); $pageClass = new page($page,$totalNum,$pageNum, WEB_URL."member/u.php?action=list", true); $pageCode = $pageClass->getCode(); $smarty->assign("webTitle","会员列表"); $smarty->assign("uList", $members); $smarty->assign("pageCode", $pageCode); $smarty->display("member/m_u_list. html "); function numTable($table='',$wheres=false) { $table = $this->dbPrefix.$table; $sql = "SELECT COUNT(*) AS num FROM `$table`"; if($wheres) { $sql .= " WHERE "; if(is_array($wheres)) { foreach($wheres as $key => $val) { $whr[] = "`$key`='".$val."'"; } $sql .= implode(" AND ",$whr); } elseif(is_string($wheres)) { $sql .= $wheres; } } $result = $this->fetch($this->query($sql)); return $result['num']; } Where 没初始化 导致可执行任意sql语句 测试： http://www.2cto.com /stcms_html/member/u.php?action=list&where={sql} 修复方案：你懂的吧
查看更多关于Stcms sql注射及修复 - 网站安全 - 自学php的详细内容...