xpshop网店系统sql注入(demo演示)

protected void Page_Load(object sender, EventArgs e)   {    if (Utils.request(base.Request.QueryString["type"]) && Utils.request(base.Request.QueryString["Action"]))    {     string text = base.Request.QueryString["Action"];     if (text != null)     {      if (!(text == "GetImg"))      {       if (text == "GetPackageGID")       {        base.Response.Write(new ProductDB().GetPackagePdtGID(int.Parse(base.Request.QueryString["PackagePID"])));       }      }      else      {       this.GetImg(base.Request.QueryString["pids"]);      }

public int GetPackagePdtGID(int productID)    {     object obj = XpShopDB.ExecuteScalar(XpShopDB.ConnectionString, CommandType.Text, "select GoodsID from Goods where ProductID = " + productID, null);     return (obj != null) ? ((int)obj) : 0;    }