详解S-CMS企业建站v3几处SQL注入

 $debug=function(){ $logFile='C:\\Users\\DELL\\Desktop\\debug.txt';   //输出的文件 $param=func_get_args();           //获取传入函数的参数 if (count($param)>0){ $str=serialize($param);           //序列号 if($str){                  //存在就写入 $str=file_get_contents($logFile)."\r\n\r\n".__FILE__.":\t\t".$str; file_put_contents($logFile,"\t\t".$str); }else{                 //不存在写入Null $str=file_get_contents($logFile)."\r\n\r\n".__FILE__.":\r\n".$str; file_put_contents($logFile,"\t\tNull"); } } };$debug($x,$a,$b);   //这里$x,$a,$b都是要查看的变量。

 case "text": $debug("select * from SL_text where T_id=" . $S_id, "T_title"); if (getrs("select * from SL_text where T_id=" . $S_id, "T_title") == "") { box("菜单指向的简介已被删除，请到“菜单管理”重新编辑", "back", "error"); } else { $page_info = ReplaceLableFlag(ReplaceWapTag(CreateHTMLReplace(CreateText(ReplaceWapPart(LoadWapTemplate($style, $S_id)) , $S_id)))); } break;

 if(isset($_GET["S_id"])){ $S_id = $_GET["S_id"]; }else{ $S_id = "0"; }

 if($action=="input"){ if ($_POST["code"]!=$_SESSION["CmsCode"]){ echo "
"; box(lang("验证码错误！/l/Verification code error"),"back","error"); }else{ $R_time=date('Y-m-d H:i:s'); $R_rid=gen_key(15); foreach ($_POST as $x=>$value) { if ($x>0){ if ($_POST[$x]==""){ box(lang("请填全内容后提交！/l/Please fill in the full content to submit!"),"back","error"); die(); }else{ if (!IsValidStr($_POST[$x])){ box(lang("您输入的内容有敏感字符，请重新输入！/l/The contents you have entered are sensitive characters, please re-enter!"),"back","error"); }else{ $debug("Insert into SL_response(R_cid,R_content,R_time,R_rid,R_member) values(".$x.",'".htmlspecialchars($_POST[$x])."','".$R_time."','".$R_rid."',".$M_id.")"); mysqli_query($conn,"Insert into SL_response(R_cid,R_content,R_time,R_rid,R_member) values(".$x.",'".htmlspecialchars($_POST[$x])."','".$R_time."','".$R_rid."',".$M_id.")"); } } } } if ($F_cq>0){ mysqli_query($conn,"Insert into SL_query(Q_code,Q_content,Q_sort) values('".$R_rid."','".date('Y-m-d H:i:s')."__用户提交表单，等待处理"."',".$F_cq.")"); box(lang("提交成功，查询码 ".$R_rid."/l/success!code ".$R_rid.""),$C_dir.$url_to,"success"); }else{ box(lang("提交成功！/l/success!code ".$R_rid.""),$C_dir.$url_to,"success"); } sendmail("您的网站有新的表单提交","
您的网站“".lang($C_webtitle)."”有新的表单提交
请进入“网站后台” - “表单系统” - “查看统计”查看详情！",$C_email); } }

 if ($action=="query"){ $Q_sort=$_POST["Q_sort"]; $Q_code=$_POST["Q_code"]; if ($_POST["code"]!=$_SESSION["CmsCode"]){ echo "
"; box(lang("验证码错误！/l/Verification code error"),"back","error"); }else{ $sql="select * from SL_query where Q_sort=".$Q_sort." and Q_code like '".$Q_code."'"; $result = mysqli_query($conn, $sql); $row = mysqli_fetch_assoc($result);