遊客站內搜尋的錯誤 - 52AV手機A片王|52AV.ONE

private function _xss_check() {
+ v3 j$ y3 u5 |, I0 ?/ M' |: Y; @% s
. w8 o/ k; e! p$ L& z% W
static $check = array('"', '>', '<', '\'', '(', ')', 'CONTENT-TRANSFER-ENCODING');: ~6 K1 T& n+ D7 D: a1 ^
6 M+ F+ e/ V2 S1 b
if(isset($_GET['formhash']) && $_GET['formhash'] !== formhash()) {) y7 L9 j5 e, Z: C3 M" T
system_error('request_tainting');
5 V `$ ]5 W1 r
}' S( y7 v! o& D5 f$ X& `
) z0 {6 v# P7 h S
if($_SERVER['REQUEST_METHOD'] == 'GET' ) {
8 w5 o/ r7 B+ T r
$temp = $_SERVER['REQUEST_URI'];
2 S: H& r& L8 P& }0 A. K' N
} elseif(empty ($_GET['formhash'])) {
; @" l, Y$ `# f# ^* H
$temp = $_SERVER['REQUEST_URI'].file_get_contents('php://input');
5 v# A* h/ H3 F9 P
} else {
' _: x6 k+ ~& ^! {" J+ n
$temp = '';
) s) g" g5 }/ [
}
1 |' ]8 r5 u- Y: M+ U
3 g( M+ b# O) d% Q' z2 j
if(!empty($temp)) {/ l$ g' M2 C$ [
$temp = strtoupper(urldecode(urldecode($temp)));
. O |5 z( D9 O2 K' Q
foreach ($check as $str) {
; ?0 D$ c7 @: o, \7 S4 s( B
if(strpos($temp, $str) !== false) {
# m0 v7 J3 r3 u, D' {$ N% t
system_error('request_tainting');
, A# K6 i4 q& \
}* d9 y# S1 S) y: R/ z W
}
8 {3 V- X( @- R; m" |
}
1 o2 u' Y( L. M( @
" P* q/ r! H5 Q% z2 e" A
return true;
6 o! g7 V, e( V8 e
}

複製代碼

private function _xss_check() {: I! Z0 x; E% ~: {6 v) O. ^' P. a
$temp = strtoupper(urldecode(urldecode($_SERVER['REQUEST_URI'])));
8 X* c: x. s: n0 s4 G
if(strpos($temp, '<') !== false || strpos($temp, '"') !== false || strpos($temp, 'CONTENT-TRANSFER-ENCODING') !== false) {, i: q! j7 L& z5 O
system_error('request_tainting');% J0 j, b0 X+ q# _) _. k
}) _# K% M2 L: ?1 S3 N5 A9 F/ R
return true;
* s1 l8 D3 g9 d/ D
}

複製代碼