多多淘宝客V7.4绕过防注入及一个注入漏洞的分析

//要过滤的非法字符 $ArrFiltrate = array ( \”#union#i\”, \”#<script#i\”, \”#/script>#i\”, \”#select#i\”, \”#alert#i\”, \”#javascript#i\”, \”#<table#i\”, \”#<td#i\”, \”#\\\”#i\”, \”#\\\’#i\”, \”#delete#i\”, \”#vbscript#i\”, \”#applet#i\”, \”#frame#i\”, \”#<div#i\”, \”#update#i\”, \”#\’#i\”, \”#union #i\”, \”#select #i\”, \”#delete #i\”, \”#update #i\”, \”#and #i\”, \”#;#i\”, \”#update#i\” ); $replacements=\’\’; function FunStringExist(&$array,$ArrFiltrate,$replacements) { if (is_array($array)) { foreach ($array as $key => $value) { if (is_array($value)) FunStringExist($array[$key],$ArrFiltrate,$replacements); else $array[$key] = preg_replace($ArrFiltrate, $replacements, $value); } } } FunStringExist($_GET,$ArrFiltrate,$replacements); FunStringExist($_POST,$ArrFiltrate,$replacements);

header(\”Content-Type:text/html;charset=utf-8\”); include \”../comm/config.php\”; $uname = trim($_GET[\”name\”]); if($uname==\’\’){ echo \”true\”; }else{ $con = @mysql_connect(\”$dbserver\”,\”$dbuser\”,\”$dbpass\” )or die(ERR_DB); mysql_select_db(\”$dbname\”,$con)or die(\”can not choose the dbname!\”); $query=\”select * from \”.$BIAOTOU.\”user where ddusername=\’\”.$uname.\”\’\”; mysql_query(\”set names utf8\”); $res=mysql_query($query); if(mysql_num_rows($res)!=0) {echo \”true\”;} else {echo \”false\”;} }