$inQuery = "INSERT INTO `detest_member` (`mtype` ,`userid` ,`pwd` ,`uname` ,`sex` ,`rank` ,`money` ,`email` ,`scores` ,

        `matt`, `spacesta` ,`face`,`safequestion`,`safeanswer` ,`jointime` ,`joinip` ,`logintime` ,`loginip` )

       VALUES ('$mtype','$userid','$pwd','$uname','$sex','10','$dfmoney','$email','$dfscores',

       '0','$spaceSta','','$safequestion','$safeanswer','$jointime','$joinip','$logintime','$loginip'); "; //在此之前没有对$uname做判断，可注入单引号

        if($dsql->ExecuteNoneQuery($inQuery))

function RecordFeeds($type, $title, $note, $aid)

    {

        global $dsql,$cfg_mb_feedcheck;

        //确定是否需要记录

        if (in_array($type,array('add','addsoft','feedback','addfriends','stow'))){

            $ntime = time();

            $title = htmlspecialchars(cn_substrR($title,255));

            if(in_array($type,array('add','addsoft','feedback','stow')))

            {

                $rcdtype = array('add'=>' 成功发布了', 'addsoft'=>' 成功发布了软件',

                                 'feedback'=>' 评论了文章','stow'=>' 收藏了');

                //内容发布处理

                $arcrul = " <a href='/plus/view.php?aid=".$aid."'>".$title."</a>";

                $title = htmlspecialchars($rcdtype[$type].$arcrul, ENT_QUOTES);

            } else if ($type == 'addfriends')

            {

                //添加好友处理

                $arcrul = " <a href='/member/index.php?uid=".$aid."'>".$aid."</a>";

                $title = htmlspecialchars(' 与'. $arcrul."成为好友", ENT_QUOTES);

            }

            $note = Html2Text($note);

            $aid = (isset($aid) && is_numeric($aid) ? $aid : 0);

            $ischeck = ($cfg_mb_feedcheck == 'Y')? 0 : 1;

            $query = "INSERT INTO `detest_member_feed` (`mid`, `userid`, `uname`, `type`, `aid`, `dtime`,`title`, `note`, `ischeck`) 

                        Values('$this->M_ID', '$this->M_LoginID', '$this->M_UserName', '$type', '$aid', '$ntime', '$title', '$note', '$ischeck'); "; //插入用户动态，这里是重点，直接使用了$this->M_UserName

            $rs = $dsql->ExecuteNoneQuery($query);

            return $rs;

        } else {

            return FALSE;

        }