if($form->status == TFORM_STATUS_GETED_VALID){

//这个是站内短信的写信息表单 的 处理

      $arr = $form->getValues();

//直接获取表单中信息

      $tos = explode(',',trim($arr['to']));

//只是分割，不是过滤

      $noExistsMenber = array();

      $toMenbers = array();

      foreach ($tos as $menber){

        $i =

        $this->DBE->getOne("select `id` from #__user where `name`='$menber'");

//一直到上面这一句都没有过滤，直接带入数据库查询了，之所以会这么写可能的原因是开发人员误以为`name`='$menber'的引号可以起到保护作用（其他的int变量都通过了inval，而这个是string啊喵，我可以输入单引号啊喵）

        if(is_null($i) or empty($i)){

          $noExistsMenber[] = $menber;

//id只要有返回就可以继续

        }else{

          $m['name'] = $menber;

          $m['id']  = $i;

          $toMenbers[] = $m;

        }

      }

      if(!empty($noExistsMenber)){

        addGlobalNotice("以下用户不存在：".implode(',',$noExistsMenber));

      }else{

        $msg['tos'] = $arr['to'];

        $msg['subject'] = $arr['subject'];

        $msg['content'] = $arr['content'];

//进入信息发送的模块了，实际上之前就已经引发注射了，但是攻击时需要读sendMessage代码

        $mMessage->sendMessage($toMenbers,$msg);

        $this->flash('成功','发送成功',bu(1,'messages','inbox'));

      }

if($form->status == TFORM_STATUS_GETED_VALID){

$newCat = $form->getValues();

if($id==0){

//create category

//check name

$name = $newCat['name'];

$nameUsed = $this->DBE->getOne("select count(*) from #__link_category where `name`='$name'");

if($nameUsed){

$form->status = TFORM_STATUS_GETED;

function sendMessage($to,$message,$type=null,$newCall=1){

//刚才检测完用户是否存在后，调用这个函数

    if(isset($to['name']) or is_string($to)){

      if(is_string($to)){

        $to['name'] = $to;

      }

      if(!isset($to['id'])){

//还记得id吗，是之前被注射SQL的返回，理论上正常应该是目标用户的id

        $to['id'] = $this->_db->getOne("select `id` from #__user where `name`='$to[name]'");

      }

//又SELECT一遍，不过name还是注射时的name，这一句也被注射了

      global $gUser;

      $message['to'] = $to['name'];

      $message['to_id'] = $to['id'];

      $message['from'] = $gUser->name;

      $message['from_id'] = $gUser->id;

      $message['create_time'] = TIME_STAMP;

      $message['type'] = $type;

      $this->insert($message);

//看到下一句，终于长舒一口气，注射可以有回显了！to_id就是我们的语句执行结果，而它会报错给我们看的！

      $this->_db->execute("update #__user set `new_msg_count`=`new_msg_count`+1 where `id`=$message[to_id]");

      if($newCall>0){

        $message['to'] = '';

        $message['to_id'] = 0;

        $this->insert($message);

        $newCall--;

      }

    }else if(is_array($to)){

      foreach ($to as $sto){

        $this->sendMessage($sto,$message,null,$newCall);

      }

    }

  }