任意sql语句执行

case 'list':
      
              $totalNum = $mysql->numTable("member", $where);
              $pageNum = 20;
              $totalPage = intval($totalNum/$pageNum) == $totalNum/$pageNum ? $totalNum/$pageNum : intval($totalNum/$pageNum)+1;
              $page = $page ? $page : 1;
              $page = $page>$totalPage ? $totalPage : $page;
              $page = $page<1 ? 1 : $page;
              $members = $mysql->select("member","id,name,time,money,provience,city,picture",$where,array("id DESC"),array(($page-1)*$pageNum,$pageNum)); www.2cto.com
              require(INCLUDE_PATH."page.class.php");
              $pageClass = new page($page,$totalNum,$pageNum, WEB_URL."member/u.php?action=list", true);
              $pageCode = $pageClass->getCode();
              $smarty->assign("webTitle","会员列表");
              $smarty->assign("uList", $members);
              $smarty->assign("pageCode", $pageCode);
              $smarty->display("member/m_u_list.html");
 
function numTable($table='',$wheres=false)
       {
              $table = $this->dbPrefix.$table;
              $sql = "SELECT COUNT(*) AS num FROM `$table`";
              if($wheres)
              {
                     $sql .= " WHERE ";
                     if(is_array($wheres))
                     {
                            foreach($wheres as $key => $val)
                            {
                                   $whr[] = "`$key`='".$val."'";
                            }
                            $sql .= implode(" AND ",$whr);
                     }
                     elseif(is_string($wheres))
                     {
                            $sql .= $wheres;
                     }
              }
              $result = $this->fetch($this->query($sql));
              return $result['num'];
       }
Where 没初始化 导致可执行任意sql语句

测试：
http://www.2cto.com /stcms_html/member/u.php?action=list&where={sql}
修复方案：你懂的吧