PHPOK 5.3 最新版前台无限制注入（二） – 先知社区

public function arc_all(project,condition=”,field=’*’,offset=0,psize=0,orderby=”)
{
if(this->_total > 100000 &&offset > 10000){
return this->_arc_all(project,condition,field,offset,psize,orderby);
}sql = ” SELECT “.field.” FROM “.this->db->prefix.”list l “;
sql .= ” JOIN “.this->db->prefix.”list_”.project[‘module’].” ext “;sql .= ” ON(l.id=ext.id AND l.site_id=ext.site_id AND l.project_id=ext.project_id) “;
if(project[‘is_biz’]){sql .= ” LEFT JOIN “.this->db->prefix.”list_biz b ON(b.id=l.id) “;
}
if(project[‘cate’] && project[‘cate_multiple’]){sql.= ” LEFT JOIN “.this->db->prefix.”list_cate lc ON(l.id=lc.id) “;
}
if(condition){
sql .= ” WHERE “.condition.” “;
}
// 拼接orderby参数
if(orderby){
sql .= ” ORDER BY “.orderby.” “;
}
if(psize){sql .= ” LIMIT “.intval(offset).”,”.psize;
}
//注入