WooYun.org

public function getuserlist($gid,$page){
          if($page=='')//传过来
            {
                $page = 1;
            }   
            $next = 35; //偏移量
            $page = ($page-1)*$next;
            $sql = "select yh.id,yh.head_img_2,yh.nickname from cj_user_group as zu 
                    left join cj_user as yh on zu.u_id = yh.id 
                    where g_id = {$gid} and zu.is_del = 0 and g_manger = 0 order by zu.create_time desc
                    limit {$page},{$next}";
            //echo $sql;exit;
            return $this->query($sql);
    }

public function edit($uid,$data) {     
        return M($this->_tableName)->where("id=".$uid)->save($data);
    }
这里where("id=".$uid)应该改为where(array("id"=>$uid))才不会导致安全问题

public function glist()
 	{
 		$page = $this->_get('page');;//获取页数
 		
		$gid = $this->_get('gid');
		$acount = $this->artMod->getcount($this->uid);//用户文章数量
		$user = $this->gro->getuserlist($gid,$page);//获取小组成员信息
         ..........