Improper use of thinkphp 3.1.3 and previous versions can cause Sqli

The function Parsesql parsing SQL statements in lib/core/model.class.php does not filter the SQL statements, which can lead to SQL injection. (Haha, in fact, using a more secure framework can cause SQLI)

Function:

/** * Parse SQL statement * @access public * @param string $sql SQL Instruction * @param boolean $parse need to parse SQL * @return string*/protected functionParsesql ($sql,$parse) {    //parsing an expression    if(true===$parse) {        $options=$this-_parseoptions (); $sql=$this->db->parsesql ($sql,$options); }ElseIf(Is_array($parse)){//SQL preprocessing        $sql=vsprintf($sql,$parse); }Else{        $sql=STRTR($sql,Array(' __table__ ' =$this->gettablename (), ' __prefix__ ' =>c (' Db_prefix '))); }    $this->db->setmodel ($this-name); return $sql;}

SQL injection is caused by writing query database code in the following way.

$model=m (' Test '); $m=$model->query (' select * from Test where id= '%s ',$_get[' id ']);d UMP ( $m ); die;

The following requests may be submitted resulting in sqli

http://Localhost/main?id=foo "or 1=" 1

Improper use of thinkphp 3.1.3 and previous versions can cause Sqli