Fanwe's social sharing system's one-sentence vulnerability and repair

Personal Profile filtering is not strict. Save the Code submitted by the user. When the template is cached and read again, the user code is directly executed! Specific: Personal Profile buried on a sentence, kitchen knife link http://www.bkjia.com/services/service. php? M = user & a = tip & uid = xxx. The first connection fails. The second one in the personal profile is cached by the system. Therefore, if the cache is not expired, the kitchen knife can be directly connected.
Solution: Filter personal profiles. Check for similar vulnerabilities elsewhere!