方正教務系統（正方）存在一處驗證碼邏輯缺口：若不請求驗證碼圖片，後端不生成驗證碼 Session，提交空驗證碼即可通過。結合 CURL 維持 Cookie，可實現自動登入並抓取課表、空教室等資料。
<?php
function curl_request($url, $post = [], $cookie = '', $returnCookie = 0) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_AUTOREFERER, 1);
curl_setopt($ch, CURLOPT_REFERER, 'https://jw.example.com/default2.aspx'); // 必須為登入頁
curl_setopt($ch, CURLOPT_TIMEOUT, 20);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
if ($post) {
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post));
}
if ($cookie) {
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
}
if ($returnCookie) {
curl_setopt($ch, CURLOPT_HEADER, 1);
}
$data = curl_exec($ch);
if (curl_errno($ch)) return curl_error($ch);
curl_close($ch);
if ($returnCookie) {
list($header, $body) = explode("\r\n\r\n", $data, 2);
preg_match_all('/Set-Cookie:([^;]*);/', $header, $matches);
return ['cookie' => substr($matches[1][0], 1), 'content' => $body];
}
return $data;
}
?>
__VIEWSTATE：請求登入頁，正則提取隱藏欄位__VIEWSTATE、學號、密碼、空驗證碼、語言、角色、登入按鈕ASP.NET_SessionId 後續請求攜帶<?php
function getViewState($url) {
$html = curl_request($url);
preg_match('//', $html, $m);
return $m[1] ?? '';
}
function login($username, $password) {
$url = 'https://jw.example.com/default2.aspx';
$post = [
'__VIEWSTATE' => getViewState($url),
'txtUserName' => $username,
'TextBox2' => $password,
'txtSecretCode' => '', // 空驗證碼
'RadioButtonList1' => iconv('UTF-8', 'GB2312', '學生'),
'Button1' => iconv('UTF-8', 'GB2312', '登錄'),
];
return curl_request($url, $post, '', true)['cookie'];
}
?>
<?php
function fetchSchedule($username, $password) {
$cookie = login($username, $password);
$viewState = getViewStateWithCookie("https://jw.example.com/xskbcx.aspx?xh=$username", $cookie);
$url = "https://jw.example.com/xskbcx.aspx?xh=$username";
$html = curl_request($url, [], $cookie);
// 解析 Table#Table1
preg_match('/
