Injection and repair of SQL statements

1, http://beijing.didatuan.com/team? Addr = % E6 % 8A % A0 % E6 % 8A % A0 % E7 % BD % 91 injected from SQL
2, http://www.didatuan.com/admin background address, and no verification code
You can obtain user information (phone number, mobile phone number, email address, and other information) through SQL injection. You may also obtain the management account password (not further tested). Even if the password cannot be decrypted, you may also obtain the email address, other information such as user name is used for social engineering. the background address is exposed and there is no verification code (although the Verification Code may not be able to prevent brute-force guesses, but it is always better). It is possible to enter the background account through brute-force guesses or other means such as social engineering.
Proof of vulnerability:
 
 
 

 
 
Solution:
 
Please respect and consider the interests of users.
 
Author: Cold night