WooYun.org

$user_id=get_sess_userid();
	$user_name=get_sess_username();
	$event_id=short_check(get_argp('event_id'));
	$pals_id=get_argp('pals_id');  //这里没过滤
	$pals_name=get_argp('pals_name');

if(!empty($pals_id)){
	$title=$user_name.$ea_langpackage->ea_invite_participate.$event_name.$ea_langpackage->ea_activity;
	$scrip_content=$user_name.$ea_langpackage->ea_invite_participate.'<a href="home.php?h='.$user_id.'&app=event_space&event_id='.$event_id.'" target="_blank">'.$event_name.'</a>'.$ea_langpackage->ea_activity.'<br />'.$ea_langpackage->ea_you_can.'<a href="javascript:void(0)" onclick="join_event('.$event_id.')">'.$ea_langpackage->ea_accept_invite.'</a>'.$ea_langpackage->ea_or_view.'<a href="home.php?h='.$user_id.'&app=event_space&event_id='.$event_id.'" target="_blank">'.$ea_langpackage->ea_event_details.'</a>';
	
	foreach($pals_id as $key => $value){
		$sql="insert into $t_event_invite (event_id,user_id,user_name,to_user_id,to_user_name,dateline) values ($event_id,$user_id,'$user_name','$value','".$pals_name[$key]."',".time().")";
		
		$dbo->exeUpdate($sql);
		echo $sql;
		exit;