小朱订单管理系统的一个注入及getshell和修复

<?php//设置工程相对路径$root_path="./";require_once("$root_path/lib/config.php");require_once("$root_path/data/dconfig.php");if(isset($_POST['realname'])){ session_start();  $db=new MySql(); //登录判断 $pro_name=str_check($_POST['pro_name']);   $pay_type=str_check($_POST['pay_type']);   $realname=str_check($_POST['realname']); $tel=str_check($_POST['tel']); $tel2=str_check($_POST['tel2']); $tmpadd=str_check($_POST['addess']); $guest=str_check($_POST['guest']);  $addess=str_check($_POST['province3']).str_check($_POST['city3']).str_check($_POST['area3']).str_check($_POST['addess']); $qq=str_check($_POST['qq']); $post=str_check($_POST['post']); $mun=intval($_POST['mun']); $email=str_check($_POST['email']); $pay_time=date("mdhis"); //来路 $referer = $_SERVER['HTTP_REFERER']; if(empty($realname)){   showmessage_go("您的姓名!");   }else{  $ip=ip();  $sql = "INSERT INTO dindan (pro_name,pay_type,pay_time, realname,tel,tel2,addess,guest,ips,lastdate,qq,post,mun,email,shen) " .      "VALUES ('$pro_name','$pay_type','$pay_time','$realname','$tel','$tel2','$addess','$guest','$ip',now(),'$qq','$post','$mun','$email','$referer')";   $res = $GLOBALS['db']->query($sql);    $mailok=0;    if(file_exists("$root_path/data/dmailconfig.php")){      require_once("$root_path/data/dmailconfig.php");   }   if($mailok==1 && $smtpusermail && $smtpemailto){    //发送    require_once("$root_path/lib/email.class.php");       $mailbody .="<h1> 姓名：".$realname."<br>";    $mailbody .="<h1> 联系电话：".$tel."<br>";    $mailbody .="<h1> 产品：".$pro_name."<br>";       $mailbody .="<h1> 地址：".$addess."<br>";      $mailtype = "HTML";//邮件格式（HTML/TXT）,TXT为文本邮件     $smtp = new smtp($smtpserver,$smtpserverport,true,$smtpuser,$smtppass);//这里面的一个true是表示使用身份验证,否则不使用身份验证.       $smtp->debug = FALSE;//是否显示发送的调试信息    $smtp->sendmail($smtpemailto, $smtpusermail, $mailsubject, $mailbody, $mailtype);   }     $msg="订单提交成功，我们会尽快为您安排发货,祝您购物愉快！";   echo "<script>alert('$msg');self.location=document.referrer</script>";   }  }?><script type="text/javascript">var _bdhmProtocol = (("https:" == document.location.protocol) ? " https://" : " http://");document.write(unescape("%3Cscript src='" + _bdhmProtocol + "hm.baidu.com/h.js%3F7377a24b653a552e0cd982b3102668da' type='text/javascript'%3E%3C/script%3E"));</script>

$ip=ip();  $sql = "INSERT INTO dindan (pro_name,pay_type,pay_time, realname,tel,tel2,addess,guest,ips,lastdate,qq,post,mun,email,shen) " .      "VALUES ('$pro_name','$pay_type','$pay_time','$realname','$tel','$tel2','$addess','$guest','$ip',now(),'$qq','$post','$mun','$email','$referer')";