WooYun.org

if ($get['catid']) {
			$more = FALSE;
			$cat_field = $module['category'][$get['catid']]['field'];
			$where[0] = '`'.$table.'`.`catid`'.($module['category'][$get['catid']]['child'] ? 'IN ('.$module['category'][$get['catid']]['childids'].')' : '='.$get['catid']);
			if ($cat_field) {
				foreach ($cat_field as $name => $field) {
					if (isset($get[$name]) && $get[$name]) {
						$more = TRUE;
						$where[] = $this->_where($table_more, $name, $get[$name], $cat_field);
					}
					if (isset($_order_by[$name])) {
						$more = TRUE;
						$order_by[] = '`'.$table.'`.`'.$name.'` '.$_order_by[$name];
					}
				}
			}
			if ($more) $from.= ' LEFT JOIN `'.$table_more.'` ON `'.$table.'`.`id`=`'.$table_more.'`.`id`';
		}
		
		// 筛选空值
		foreach ($where as $i => $t) {
			if (!$t) {
                unset($where[$i]);
            }
		}
		$where = $where ? 'WHERE '.implode(' AND ', $where) : '';
		
		// 最大数据量
		$limit = (int)$module['setting']['search']['total'] ? ' LIMIT '.(int)$module['setting']['search']['total'] : '';
		
		// 组合sql查询结果
		$sql = "SELECT `{$table}`.`id` FROM {$from} {$where} ORDER BY ".implode(',', $order_by).$limit;