一个可能被注入的地方，官方也有

示例：http://x.discuz.net/491698/spacelist_type_image_itemtypeid_100%20BugFindByIce
表现：

1. SupeSite info: MySQL Query Error
   
2. 
   
3. Time: 2006-11-27 8:49pm
   
4. Script: /491698/spacelist_type_image_itemtypeid_100 BugFindByIce
   
5. 
   
6. SQL: SELECT dateline FROM supe_spaceitems WHERE uid=491698 AND type='image' AND itemtypeid=100 BugFindByIce AND folder=1 AND dateline BETWEEN 1162310400 AND 1164902400
   
7. Error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'BugFindByIce AND folder=1 AND dateline BETWEEN 1162310400 AND 1
   
8. Errno.: 1064
   
9. 
   
10. Similar error report has beed dispatched to administrator before.
    

复制代码

关注……………………

我试过加入and等代码，能被识别

谢谢您的反馈
我们检查下

谢谢楼主的反馈，这个是日历模块的sql所致，我已经找到解决方法。

原帖由 sup 于 2006-11-28 14:21 发表
谢谢楼主的反馈，这个是日历模块的sql所致，我已经找到解决方法。

尽快给我们补丁吧，有点不安呢