看到论坛有人发了一这程序的文章,刚好没事情做

就顺便看了下

既然是找gs就先看看写出文件的吧

function WritePhpCache($filename,$array,$arrayname)//解析二维数组并写缓存
{
        
        $cachewrite = "<?php\n if(!defined('IN_SITE')) exit('Access Denied');\n"; //虽然做过处理不能直接访问 但是直觉告诉我写出的文件会被包含进来
        $cachewrite.= "\$".$arrayname."=array(\n";
        if(is_array($array))
        {
                foreach($array as $key=>$v)
               {
                       if(is_array($v))
                       {
                               
                               $cachewrite.='"'.$key.'"=>array('."\n";
                               foreach($v as $k=>$b)
                               {
                                       $cachewrite.="\t\t".'"'.$k.'"=>"'.$b.'",'."\n";         //都是双引号 ,可以代码执行
                               }
                               $cachewrite.="),\n";
                       }else
                       {
                               $cachewrite.='"'.$key.'"=>"'.$v.'",'."\n";        
                       }
               
               } 
        }
       
       
        $cachewrite.=");\n";
        
        $cachewrite.="\n?>";
        
        swritefile($filename,$cachewrite);
}

调用

$filename = "include/data/configure.data.php";
file_exists($filename) && include $filename; 果然包含了
省略若干代码,,
                    default: //后台修改配置。。
                            $configcache = array (
                                        'pagesize'=>$CONFIGURE["pagesize"],
                                    'board_pagesize'=>$CONFIGURE["board_pagesize"],    
                                        'title'=>$CONFIGURE["title"],
                                        'filter'=>$CONFIGURE["filter"],
                                        'weathercityno'=>$CONFIGURE["weathercityno"],      
                                    'ipInterval'=>$CONFIGURE["ipInterval"],   
                                        'ischeck'=>$CONFIGURE["ischeck"],
                                        'systemuser'=>$CONFIGURE["systemuser"],
                                    'weathercityno'=>$CONFIGURE['weathercityno'],
                                        'tp'=>$CONFIGURE['tp']
                                );
                    break;
            }
                WritePhpCache($filename,$configcache,"CONFIGURE"); //写出

test.. 后台修改设置。。。

转自:http://www.90sec.org/viewthread.php?tid=1968&extra=page%3D1%26amp%3Borderby%3Ddateline%26amp%3Bfilter%3D2592000