每周一插 | MetInfo内容管理系统sql注入

<?php

# MetInfo Enterprise Content Management System 

# Copyright (C) MetInfo Co.,Ltd (http://www.metinfo.cn). All rights reserved. 

require_once '../include/common.inc.php';

if(!$id && $class1)$id = $class1;

$show = $db->get_one("SELECT * FROM $met_column WHERE id=$id and module=1");

if(!$show||!$show['isshow']){

okinfo('../404.html');

}

$metaccess=$show[access];

if($show[classtype]==3){

$show3 = $db->get_one("SELECT * FROM $met_column WHERE id='$show[bigclass]'");

$class1=$show3[bigclass];

$class2=$show[bigclass];

$class3=$show[id];

}else{

$class1=$show[bigclass]?$show[bigclass]:$id;

$class2=$show[bigclass]?$id:"0";

$class3=0;

}