disucz代码分析

1.discuz/templates/default/viewthread_fastpost.htm :
表单中请求地址为action="post.php?action=reply&amp;fid=$fid&amp;tid=$tid&amp;extra=$extra&amp;replysubmit=yes<!--{if $ordertype != 1}-->&infloat=yes&handlekey=fastpost
看最后的handlekey=fastpost

2.discuz/post.php 引入了 bbs/include/newreply.inc.php

		
	//file_put_contents('bbbb.txt',"viewthread.php?tid=$tid&pid=$pid&page=$page&extra=$extra#pid$pid");
	//viewthread.php?tid=1&pid=21&page=2&extra=page%3D1#pid21
	showmessage($replymessage, "viewthread.php?tid=$tid&pid=$pid&page=$page&extra=$extra#pid$pid");

3.discuz/include/global.func.php 中showmessage();

	elseif($handlekey) 
	{
		$show_message = str_replace("'", "\'", $show_message);
		if($url_forward) 
		{
			$show_message = "<script type=\"text/javascript\" reload=\"1\">
							\nif($('return_$handlekey')) $('return_$handlekey').className = 'onright';\n
							if(typeof submithandle_$handlekey =='function') 
							{
								submithandle_$handlekey('$url_forward', '$show_message');
							} 
							else 
							{
								location.href='$url_forward';//这就是跳转回来提交页，在下面模板中被echo
							}\n
							</script>";
		} 
		省略.....	
	}	

showmessage()最后

	include template('showmessage');

4.disucz/templates/default/showmessage.htm

	{echo str_replace(array({lang return_search}), array({lang return_replace}), $show_message)}

最后说下一个被我忽视的问题：showmessage中$handlekey 是从何来的，我本以为是common.inc.php中的GPC，实际因为函数作用域的问题其实是extract($GLOBALS, EXTR_SKIP);中取得的.