-
-
[求助]thinkphp 绕过I函数验证
-
发表于:
2017-10-1 15:25
3656
-
$morders = D('Home/Gappraises'); //这里的D方法是否 有对数据进行校验
$obj["userId"] = $USER['userId'];
$obj["orderId"] = (int)I("orderId"); //这里被int强制转换还能绕过吗
$rs = $morders->getses($obj);
getses($obj){
$userId = $obj["userId"];
$orderId = $obj["orderId"];
$data = array();
$sql = "SELECT o.*,sp.shopId,sp.shopName FROM __PREFIX__orders o,__PREFIX__shops sp WHERE o.orderStatus in (4,5) and o.shopId=sp.shopId AND o.orderId = $orderId ";
$order = $this->queryRow($sql);
......
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
