IBOS协同办公平台一处sql注入

public function actionDel() {
         if (IBOS::app()->request->isAjaxRequest) {
             $repids = Env::getRequest('repids');
             $uid = IBOS::app()->user->uid;
             if (empty($repids)) {
                 $this->error(IBOS::lang('Parameters error', 'error'),
                         $this->createUrl('default/index'));
             }
             $pk = '';
             if (strpos($repids, ',')) {
                 $repids = trim($repids, ',');
                 $pk = explode(',', $repids);
             } else {
                 $pk = array($repids);
             }
             $reports = Report::model()->fetchAllByPk($pk);
             foreach ($reports as $report) {
                 // 权限判断
                 if ($report['uid'] != $uid) {
                     $this->ajaxReturn(array('isSuccess' => false, 'msg' => IBOS::lang('You do not have permission to delete the report')));
                 }
             }
             //删除附件
             $aids = Report::model()->fetchAllAidByRepids($pk);
             if ($aids) {
                 Attach::delAttach($aids);
             }
             //若已安装日程，删除关联表数据和有提醒时间的日程
             $isInstallCalendar = Module::getIsEnabled('calendar');
             if ($isInstallCalendar) {
                 Calendars::model()->deleteALL("`calendarid` IN(select `cid` from {{calendar_rep_record}} where FIND_IN_SET(`repid`, '{$repids}')) ");
                 CalendarRepRecord::model()->deleteAll("repid IN ({$repids})");