WooYun.org

if ( trim( $_GET['pageurl'] ) != "" )
{
    $search_text = "";
    $referer = trim( $_GET['referer'] );
    $domain = substr( $referer, strpos( $referer, "//" ) + 2 );
    $domain = substr( $domain, 0, strpos( $domain, "/" ) );
    if ( strpos( $domain, "google." ) === FALSE )
    {
        $string = explode( "q=", $referer );
        $string = explode( "&", $string[1] );
        $search_text = urldecode( $string[0] );
    }
.....
.....
 $search_text = str_replace( "+", " ", $search_text );
    time( )( "insert into ".$site->table( "statistics" )." (referer,pageurl,firsttime,lasttime,timezone,ip,date_added,domain,search_text) value
    ('".trim( $_GET['referer'] )."','".trim( $_GET['pageurl'] )."','".trim( $_GET['firsttime'] )."','".trim( $_GET['lasttime'] )."','".trim( $_GET['timezone'] )."','".real_ip( )."','".date( "Y-m-d H:i:s", time( ) )."','".$domain."','".$search_text."')" );