Team:t00ls  Author: Cond0r
 看代码
Index.class.php

…若干………
function search_action()
        {
       
                $keyword = $_REQUEST['keyword'];
                if(empty($keyword))
                {
                        exit;
                }
………若干…
                if($_REQUEST['brand'])
                {
                        $container.="  AND brand = ".$_REQUEST['brand']; //你懂的
                        $ext['brand'] = $_REQUEST['brand'];
                }       
……若干……
测试方法:

http://www.2cto.com /index.php?act=s ... 0x)a)%20and%201=1/*

www.2cto.com修复方案

过滤该输入