WooYun.org

public function tag($tag,$page=1){
    	if(is_numeric($page)) { //传参过滤
	    	$condition['type'] = 'article';
	    	$date = strtotime("now");
        	$args_id = M('meta')->where("meta_key='tag' AND meta_value='$tag' AND type='basic'")->getField('page_id',true);//$tag直接带入了
        	$condition['id']  = array('in',$args_id);
	    	$this->page = M('page')->where($condition)->order('date desc')->page($page,mc_option('page_size'))->select();//由于这里还有一句，所有用盲注
		    $count = M('page')->where($condition)->count();
		    $this->assign('id',$id);
		    $this->assign('count',$count);
		    $this->assign('page_now',$page);
			$this->theme(mc_option('theme'))->display('article/term');
		} else {
			$this->error('参数错误！');
		}
	}