Easethink another SQL Injection

. /Subscribe. there is a problem on the php page. Except for the $ _ REQUEST ['act '] = 'mail' option, no page sending information is added. Other options are combined with user sending information. Post form information.

Elseif ($ _ REQUEST ['ac'] = 'unsubscribe ') {$ email_code = trim ($ _ REQUEST ['code']); // only the pre-defined characters $ email = base64_decode ($ email_code) are removed ); // simple base64_decode encoding is followed by the if ($ GLOBALS ['db']-> getOne ("select count (*) from ". DB_PREFIX. "mail_list where mail_address = '". $ email. "'") = 0) {showErr ($ GLOBALS ['lang'] ['mail _ NOT_EXIST '], 0, APP_ROOT);} else {send_unsubscribe_mail ($ email ); showSuccess ($ GLOBALS ['lang '] ['mail _ UNSUBSCRIBE_VERIFY'], 0, APP_ROOT) ;}} elseif ($ _ REQUEST ['ac'] = 'domainsubscribe ') {$ email_code = trim ($ _ REQUEST ['code']); // the same error as the above $ email_code = base64_decode ($ email_code ); $ arr = explode ("|", $ email_code); $ GLOBALS ['db']-> query ("delete from ". DB_PREFIX. "mail_list where code = '". $ arr [0]. "'and mail_address = '". $ arr [1]. "'"); $ rs = $ GLOBALS ['db']-> affected_rows (); if ($ rs) {showSuccess ($ GLOBALS ['lang '] ['mail _ UNSUBSCRIBE_SUCCESS'], 0, APP_ROOT );} else {showErr ($ GLOBALS ['lang '] ['mail _ UNSUBSCRIBE_FAILED'], 0, APP_ROOT );}}

 

You can see that the user input is easily included in the SQL statement, but the final result is not directly displayed on the page. Whether the statement execution is successful depends on the Response Information on the page.

  Solution:

Filter keywords