<?
require_once('mysqli.php');
$zhi='';
if($_POST['update']=='true'){
foreach($_POST as $k=>$v){
if( $k!=('idd') && $k!=('update')&& strstr($v,'delete')==null && strstr($v,'drop')==null &&strstr($v,'union')==null ){
$zhi.= $k."='".$v."',";
}
}
$zhi = substr($zhi,0,-1);
$query = "update `wenzhang` set ".$zhi." where id =".$_POST['id'];
if(mysqli_query($link,$query)){
echo '修改成功';
}else{
echo '修改失败';
}
die();
}
$zhi='';
foreach($_POST as $k=>$v){
if(strstr($v,'delete')==null && strstr($v,'drop')==null &&strstr($v,'union')==null && $k!='suoluetu')
$zhi.= "\"".$v."\",";
}
$zhi = substr($zhi,0,-1);
$query = "insert into `wenzhang` (type,time,title,body) values(".$zhi.");";
if(mysqli_query($link,$query)){
echo '添加成功';
}else{
echo '添加失败php';
}
?>

这是什么。。。召唤ted大法？