74cms 最新版sql注入漏洞

elseif($act=="ajax_collect_resume_add")
 {
  $resume_id=$_POST["resume_id"];
  $sql="select * from ".table("company_favorites")." where resume_id=$resume_id and company_uid=$_SESSION[uid] ";
  $collect_resume=$db->getone($sql);
  if($_SESSION["utype"]!=1){
   exit("企业会员登录后收藏简历");
  }
  else if($collect_resume)
  {
   exit("您已经收藏过此简历");
  }
  else
  {
   $setsqlarr["resume_id"]=$resume_id;
   $setsqlarr["company_uid"]=$_SESSION["uid"];
   $setsqlarr["favoritesa_ddtime"]=time();
   inserttable(table('company_favorites'),$setsqlarr)?exit("ok"):exit("err");
  }