PHP Injection 예제들

예제 #1

파일: Login.php 프로젝트: DaiDanRui/LinHang

function try_to_login()
{
    $username = Injection::excute('username');
    $password = Injection::excute('pwd');
    //  echo $username;
    // echo $password;
    include_once 'class/DBtraverser.php';
    include_once 'class/Config.php';
    include_once 'class/Config_user.php';
    $myDBtraveser = new DBtraverser(Config_user::table_name, ' where ' . Config_user::log_name . "='{$username}'");
    $retval = $myDBtraveser->excute_without_conn();
    //handle the login result
    if (mysqli_num_rows($retval) == 0) {
        echo "<script language='javascript'> alert('wrong log name!');\r\n                window.history.go(-1);\r\n                </script>";
    } else {
        $complete_ary = mysqli_fetch_array($retval, MYSQLI_ASSOC);
        if ($complete_ary[Config_user::password] == $password) {
            $_SESSION['CURRENT_LOGIN_USER'] = $username;
            $_SESSION['CURRENT_LOGIN_ID'] = $complete_ary[Config_user::id];
            mysqli_free_result($retval);
            header("Location:Commodity_browse.php");
        } else {
            mysqli_free_result($retval);
            echo "<script language='javascript'> alert('wrong password!');\r\n                window.history.go(-1);\r\n                </script>";
        }
    }
}

예제 #2

파일: Commodity_leave_message.php 프로젝트: DaiDanRui/LinHang

/**
 * 前置： 必须满足已经判断确定用户已经登陆
 * @param unknown $conn 数据库连接
 */
function add_message_to_DB($conn, $commodity_id)
{
    require_once 'class/DBadder.php';
    require_once 'class/Config_leave_message.php';
    require_once 'class/Config.php';
    require_once 'class/Injection.php';
    $talker_id = $_SESSION['CURRENT_LOGIN_ID'];
    $talker_content = Injection::excute('content');
    $array = array(Config_leave_message::commodity_id => $commodity_id, Config_leave_message::content => $talker_content, Config_leave_message::talker => $talker_id, Config_leave_message::time => date('Y-m-d H:i:s', time()));
    $DBadder = new DBadder(Config_leave_message::tbl_name, $array);
    return $DBadder->excute($conn);
}

예제 #3

파일: Commodity_upload.php 프로젝트: DaiDanRui/LinHang

function upload()
{
    if (isset($_SESSION['CURRENT_LOGIN_ID'])) {
        require_once 'class/Config_commodity.php';
        require_once 'class/Injection.php';
        require_once 'class/Config.php';
        $conn = Config::connect();
        $course_or_reward = 1;
        if (isset($_REQUEST['course_or_reward'])) {
            $course_or_reward = $_REQUEST['course_or_reward'] == 'skill' ? 1 : 2;
        }
        $commodity_message = array(Config_commodity::course_or_reward => (int) $_GET['course_or_reward'], Config_commodity::type => isset($_POST['type']) ? Injection::excute('type') : '其他', Config_commodity::publisher => $_SESSION['CURRENT_LOGIN_ID'], Config_commodity::price => (int) $_POST['price'], Config_commodity::release_date => date('Y-m-d H:i:s', time()), Config_commodity::deleted_date => date('Y-m-d H:i:s', time()), Config_commodity::title => Injection::excute('topic'), Config_commodity::description => Injection::excute('description'), Config_commodity::communication_number => Injection::excute('phone'));
        include_once 'class/DBadder.php';
        $myDBadder = new DBadder(Config_commodity::table_name, $commodity_message);
        //$myDBadder->excute($conn);
        upload_pictures($conn, mysqli_insert_id($conn));
        header('Commodity_browse.php');
    } else {
        include 'Login.php';
    }
}

예제 #4

파일: Transaction_acceptor_comfirm.php 프로젝트: DaiDanRui/LinHang

function create_transaction($conn, $commodity_ary)
{
    include_once 'class/DBadder.php';
    include_once 'class/Config_transaction.php';
    include_once 'class/Config_commodity.php';
    include_once 'class/commodity/Transaction_state_config.php';
    include_once 'class/commodity/Commodity_type_Config.php';
    $buyer = -1;
    $holder = -1;
    $commodity_acceptor_id = Injection::excute('commodity_acceptor_id');
    if ($commodity_ary[Config_commodity::course_or_reward] == Commodity_type_Config::course) {
        $holder = $commodity_ary[Config_commodity::publisher];
        $buyer = $commodity_acceptor_id;
    } else {
        $buyer = $commodity_ary[Config_commodity::publisher];
        $holder = $commodity_acceptor_id;
    }
    $myary = array(Config_transaction::choosed_id => $commodity_ary[Config_commodity::id], Config_transaction::state => Transaction_state_config::acceptor_comfirmed, Config_transaction::commodity_buyer_id => $buyer, Config_transaction::commodity_holder_id => $holder, Config_transaction::price => $this->commodity_ary[Config_commodity::price], Config_transaction::date_choose => date('Y-m-d H:i:s', time()), Config_transaction::date_confirm => date('Y-m-d H:i:s', 0), Config_transaction::pay_id => substr(md5(time()), 0, 8), Config_transaction::course_or_reward => $commodity_ary[Config_commodity::course_or_reward]);
    $adder = new DBadder(Config_transaction::table_name, $myary);
    return $adder->excute($conn);
}

예제 #5

파일: Register3.php 프로젝트: DaiDanRui/LinHang

/**
 *
 */
function register()
{
    include_once 'class/DBadder.php';
    $myDBadder = new DBadder(Config_user::table_name, $this->ary);
    if ($myDBadder->excute_without_conn()) {
        return false;
    } else {
        return true;
    }
}
if (isset($_POST['next'])) {
    $_SESSION['register_user'][Config_user::nick_name] = Injection::excute('input_nick');
    $_SESSION['register_user'][Config_user::birthday] = date('Y-m-d H:i:s', time());
    $_SESSION['register_user'][Config_user::phone_number] = Injection::excute('input_phone');
    $_SESSION['register_user'][Config_user::email] = Injection::excute('input_email');
    if (register($_SESSION['register_user'])) {
        $smarty->display("login.html");
    } else {
        //what if login failed
        $smarty->display("Login&Register/register-3.html");
    }
} else {
    if (isset($_POST['return'])) {
        $smarty->display("Login&Register/register-2.html");
    } else {
        $smarty->display("Login&Register/register-3.html");
    }
}

예제 #6

파일: Register2.php 프로젝트: DaiDanRui/LinHang

<?php

session_start();
include_once 'smarty_init.php';
include_once 'class/Config_user.php';
if (isset($_POST['next'])) {
    $_SESSION['register_user'][Config_user::school] = Injection::excute('input_sch');
    $_SESSION['register_user'][Config_user::school_id] = Injection::excute('input_stu_id');
    $_SESSION['register_user'][Config_user::legal_name] = Injection::excute('input_name');
    $_SESSION['register_user'][Config_user::sex] = Injection::excute('sex');
    $smarty->display("register3.html");
} else {
    if (isset($_POST['return'])) {
        $smarty->display("Login&Register/register-1.html");
    } else {
        $smarty->display("Login&Register/register-2.html");
    }
}

예제 #7

파일: Person_course.php 프로젝트: DaiDanRui/LinHang

<?php

session_start();
if (isset($_SESSION['CURRENT_LOGIN_ID'])) {
    require_once 'class/Injection.php';
    require_once 'class/Config_commodity.php';
    require_once 'Include_commodity_browse.php';
    include 'smarty_init.php';
    //1.获取限定条件
    $where = 'where ' . Config_commodity::publisher . " = '" . $_SESSION['CURRENT_LOGIN_ID'] . "'";
    if ($_GET['course_or_reward']) {
        $where .= 'AND' . Config_commodity::course_or_reward . ' = ' . "'" . Injection::excute('course_or_reward') . "'";
    }
    if ($_GET['type']) {
        $where .= 'AND' . Config_commodity::type . ' = ' . "'" . Injection::excute('type') . "'";
    }
    $order_field = isset($_GET['oder']) ? Injection::excute('order') : Config_commodity::release_date;
    $where .= 'ORDER BY ' . $order_field;
    //2.获取数组数据
    $list = pagination($where);
    //3.显示数据
    $smarty->assign('page', $list['page']);
    $smarty->assign('array', $list['array']);
    $smarty->display('');
} else {
    include 'Login.php';
}

예제 #8

파일: My_info_set.php 프로젝트: DaiDanRui/LinHang

<?php

/**
 * 个人设置： 好评度*2 手机  昵称  姓名 性别  邮箱 圣体 擅长 爱好 个性签名
 * 账号设置： 密码
 * 主题设置
 */
session_start();
if (isset($_SESSION['CURRENT_LOGIN_ID'])) {
    include 'smarty_init.php';
    require_once 'class/Config_user.php';
    $where = ' where ' . Config_user::id . ' = ' . "'" . $_SESSION['CURRENT_LOGIN_ID'] . "'";
    $autograph = Injection::excute('');
    $birthday = Injection::excute('');
    $eamil = Injection::excute('');
    $interestc = Injection::excute('');
    $nick_name = Injection::excute('');
    $sex = Injection::excute('');
    $strongpoint = Injection::excute('');
    $ary = array(Config_user::autograph => $autograph, Config_user::birthday => $birthday, Config_user::email => $eamil, Config_user::interestc => $interestc, Config_user::nick_name => $nick_name, Config_user::sex => $sex, Config_user::strongpoint => $strongpoint);
    $DBupdater = new DBupdater(Config_user::table_name, $ary, $where);
    $smarty->assign('');
    $smarty->display('');
} else {
    include 'Login.php';
}

예제 #9

파일: Register.php 프로젝트: DaiDanRui/LinHang

 * @param string $username
 */
function is_username_exist($username)
{
    include_once 'class/DBtraverser.php';
    include_once 'class/Config.php';
    include_once 'class/Config_user.php';
    include_once 'class/DBcount.php';
    $ary = ' where ' . Config_user::log_name . " = '{$username}' ";
    $myDBcount = new DBcount(Config_user::table_name, $ary);
    $retval = $myDBcount->excute_without_conn();
    $row = mysqli_fetch_array($retval, MYSQLI_NUM);
    return $row ? $row[0] : 0;
}
if (isset($_POST['reg'])) {
    require_once 'class/Injection.php';
    $name = Injection::excute('username');
    $pwd = Injection::excute('pwd');
    $phone = Injection::excute('phone');
    $register_user = array(Config_user::is_seller => 1, Config_user::create_time => date('Y-m-d H:i:s', time()), Config_user::last_log => date('Y-m-d H:i:s', time()), Config_user::phone_number => $phone, Config_user::seller_credit => 5, Config_user::payer_credit => 5, Config_user::log_name => $name, Config_user::password => $pwd, Config_user::pic_path => 'avatar.jpg');
    if (is_username_exist($name)) {
    } else {
        include_once 'class/DBadder.php';
        $myDBadder = new DBadder(Config_user::table_name, $register_user);
        if ($myDBadder->excute_without_conn()) {
            $smarty->display("Login&Register/Login.html");
        }
    }
} else {
    $smarty->display("Login&Register/Register.html");
}

예제 #10

파일: Register1.php 프로젝트: DaiDanRui/LinHang

 * @param string $username
 */
function is_username_exist($username)
{
    include_once 'class/DBtraverser.php';
    include_once 'class/Config.php';
    include_once 'class/Config_user.php';
    include_once 'class/DBcount.php';
    $ary = ' where ' . Config_user::log_name . " = '{$username}' ";
    $myDBcount = new DBcount(Config_user::table_name, $ary);
    return $myDBcount->excute_without_conn();
}
if (isset($_POST['next']) && $_POST['next'] == "true") {
    require_once 'class/Injection.php';
    $register_user = array(Config_user::is_seller => 1, Config_user::is_active => 1, Config_user::create_time => date('Y-m-d H:i:s', time()), Config_user::last_log => date('Y-m-d H:i:s', time()), Config_user::seller_credit => 5, Config_user::payer_credit => 5, Config_user::income => 0, Config_user::pay => 0, Config_user::count_publish_course => 0, Config_user::count_publish_reward => 0, Config_user::count_choose_course => 0, Config_user::count_choose_reward => 0, Config_user::log_name => Injection::excute('input_user'), Config_user::password => Injection::excute('input_pwd'));
    if (is_username_exist(Injection::excute('input_user'))) {
        //if already exist
        $smarty->display("Login&Register/register-1.html");
        /* echo '<script type="text/javascript">
           window.onload=function(){
               alert("chenggong");
               history.go(-1);
           }</script>'; */
    } else {
        $_SESSION['register_user'] = $register_user;
        $smarty->display("Login&Register/register-2.html");
    }
} else {
    if (isset($_POST['return'])) {
        $smarty->display("Login&Register/login.html");
    } else {