-
-
[求助]thinkphp 绕过I函数验证
-
发表于:
2017-10-1 15:25
3654
-
$morders = D('Home/Gappraises'); //这里的D方法是否 有对数据进行校验
$obj["userId"] = $USER['userId'];
$obj["orderId"] = (int)I("orderId"); //这里被int强制转换还能绕过吗
$rs = $morders->getses($obj);
getses($obj){
$userId = $obj["userId"];
$orderId = $obj["orderId"];
$data = array();
$sql = "SELECT o.*,sp.shopId,sp.shopName FROM __PREFIX__orders o,__PREFIX__shops sp WHERE o.orderStatus in (4,5) and o.shopId=sp.shopId AND o.orderId = $orderId ";
$order = $this->queryRow($sql);
......
[课程]FART 脱壳王!加量不加价!FART作者讲授!