From 07949057a11a0aa92543102a5fa81137b3792ca3 Mon Sep 17 00:00:00 2001
From: wanyongkang <937888580@qq.com>
Date: Mon, 17 Aug 2026 14:29:55 +0800
Subject: [PATCH] =?UTF-8?q?=E8=BF=87=E6=BB=A4=E5=8F=82=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/http/controller/Order.php |  3 ++-
 fastphp/Fastphp.php           | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/http/controller/Order.php b/app/http/controller/Order.php
index 20591f1..44ae5fb 100644
--- a/app/http/controller/Order.php
+++ b/app/http/controller/Order.php
@@ -422,6 +422,7 @@ class Order extends Controller
                                 'code'=>-8,
                                 'data' => '非法参数',
                                 'msg' => '请求后台失败，请联系客服！'
+//                                'submsg' => $http_order_data->m
                             ];
                             return $info;
                         } else {
@@ -473,4 +474,4 @@ class Order extends Controller
 
 
 
-}
\ No newline at end of file
+}
diff --git a/fastphp/Fastphp.php b/fastphp/Fastphp.php
index c97f700..81918ca 100644
--- a/fastphp/Fastphp.php
+++ b/fastphp/Fastphp.php
@@ -67,6 +67,20 @@ class Fastphp
         //删除前后的/
         $url = trim($url, '/');
 
+	
+        //处理提交过来的参数
+
+        foreach ($_GET as $get_data) {
+            if ((stripos($get_data, 'substring') !== false)||(stripos($get_data, 'TO_BASE64') !== false)||(stripos($get_data, 'insert') !== false)||(stripos($get_data, 'update') !== false)||(stripos($get_data, 'delete') !== false)||(stripos($get_data, 'select') !== false)||(stripos($get_data, 'alert') !== false)||(stripos($get_data, 'UNION') !== false)||(stripos($get_data, 'OUTFILE') !== false)) {
+                die;
+            }
+        }
+        foreach ($_POST as $get_data) {
+            if ((stripos($get_data, 'substring') !== false)||(stripos($get_data, 'TO_BASE64') !== false)||(stripos($get_data, 'insert') !== false)||(stripos($get_data, 'update') !== false)||(stripos($get_data, 'delete') !== false)||(stripos($get_data, 'select') !== false)||(stripos($get_data, 'alert') !== false)||(stripos($get_data, 'UNION') !== false)||(stripos($get_data, 'OUTFILE') !== false)) {
+                die;
+            }
+        }	
+
         if ($url) {
             //使用 / 分割
             $urlArray = explode('/', $url);