WooYun.org

tag("moduleid=$mid&table=keyword&condition=moduleid=$mid and keyword like '%$word%'&pagesize=10&order=total_search desc&template=list-search_tip", -2);

$parameter = str_replace(array('&', '%'), array('', '##'), $parameter);（//如果这个没有替换%号的就又有一个注射了..）
	$parameter = strip_sql($parameter);
	parse_str($parameter, $par);//解析字符串 我们可以把word =%26变量=值这样就行了e~
	if(!is_array($par)) return '';
	$par = dstripslashes($par);
	extract($par, EXTR_SKIP); //倒入变量  下面一大堆我们都可以覆盖的
 
	isset($prefix) or $prefix = $db->pre;
	
	isset($moduleid) or $moduleid = 1;
	if(!isset($MODULE[$moduleid])) return '';
	isset($fields) or $fields = '*';
	isset($catid) or $catid = 0;
	isset($child) or $child = 1;
	isset($areaid) or $areaid = 0;
	isset($areachild) or $areachild = 1;
	(isset($dir) && check_name($dir)) or $dir = 'tag';
	(isset($template) && check_name($template)) or $template = 'list';
	isset($condition) or $condition = '1';
	isset($group) or $group = '';
	isset($page) or $page = 1;
	isset($offset) or $offset = 0;
	isset($pagesize) or $pagesize = 10;
	isset($order) or $order = '';
	isset($showpage) or $showpage = 0;
	isset($showcat) or $showcat = 0;
	isset($datetype) or $datetype = 0;
	isset($target) or $target = '';
	isset($class) or $class = '';
	isset($length) or $length = 0;
	isset($introduce) or $introduce = 0;
	isset($debug) or $debug = 0;
	isset($lazy) or $lazy = 0;
	(isset($cols) && $cols) or $cols = 1;
      。。。沈略。。
$query = "SELECT ".$fields." FROM ".$table." WHERE ".$condition.$order." LIMIT ".$offset.",".$pagesize;//我们之间覆盖  $fields 
	if($debug) echo $parameter.'<br/>'.$query.'<br/>';
	$tags = $catids = $CATS = array();
	$result = $db->query($query, $db_cache, $tag_expires);//入库查询
   。。。沈略。。
include template($template, $dir);//包含模板文件 （template在后面不可更改的）
应为tag穿过来的是template=list-search_tip

{loop $tags $i $t}<div onclick="setTip('{$t[word]}');" onmouseover="this.className='search_t_div_2';" onmouseout="this.className='search_t_div_1';" class="search_t_div_1"><span>{$t[items]} 结果</span>{$t[word]}</div>{/loop}