【PHP代码审计】 那些年我们一起挖掘SQL注入 - 2.全局防护Bypass之UrlDecode

/**
    +----------------------------------------------------------
    * 如果 magic_quotes_gpc 为关闭状态，这个函数可以转义字符串
    +----------------------------------------------------------
    * @access public
    +----------------------------------------------------------
    * @param string $string 要处理的字符串
    +----------------------------------------------------------
    * @return string
    +----------------------------------------------------------
    */
   static public function addSlashes($string) {
       if (!get_magic_quotes_gpc()) {
           $string = addslashes($string);
       }
       return $string;
   }

public function topic()
{
    $keyword = $this->_get(‘keyword‘, ‘urldecode‘);//使用ThinkPHP框架自带的_get对接收的keyword参数进行urldecode(详见http://doc.thinkphp.cn/manual/get_system_var.html)
    if ($keyword) {
        $topic = D(‘Topic‘)->where("topicname=‘$keyword‘")->find();//ok，带入查询了
        if ($topic) {
            $isfollow = D(‘Mytopic‘)->isfollow($topic[‘id‘], $this->my[‘user_id‘]);
            $topicusers = D(‘MytopicView‘)->where("topicid=‘$topic[id]‘")->order(‘id desc‘)->limit(9)->select();
            $widget = M(‘Topicwidget‘)->where("topicid=‘$topic[id]‘")->order(‘`order` ASC‘)->select();
            if ($widget) {
                foreach ($widget as $val) {
                    $topicwidget[$val[‘widgettype‘]][] = $val;
                }
            }
            $this->assign(‘topicwidget‘, $topicwidget);
        } else {
            $count = $isfollow = 0;
        }

        $this->assign(‘comefrom‘, ‘topic‘);
        $this->assign(‘keyword‘, $keyword);
        $this->assign(‘topic‘, $topic);
        $this->assign(‘topicusers‘, $topicusers);
        $this->assign(‘isfollow‘, $isfollow);
        $this->assign(‘subname‘, ‘#‘ . $keyword . ‘#‘);
        $this->display();
    } else {
        header("location:" . SITE_URL . ‘/?m=topic&a=index‘);
    }
}