$userName = !empty($_POST['userName']) ? trim($_POST['userName']) : '';#这样的判断弱爆了

   $userPwd = !empty($_POST['userPwd']) ? trim($_POST['userPwd']) : '';#这样的判断弱爆了

   if (!empty($userName))

   {    

       require_once($dRootDir . 'inc/classes/db.php');

       $db = new Db($gDb);

       $arr = $db->fetchRow("SELECT f_id, f_userPwd, f_groupId FROM " . $gDb['prefix'] . "admins WHERE (f_userName='$userName')");#完美注入

       

       if (!empty($arr['f_id']) && ($arr['f_userPwd'] == MD5($userPwd)))

       {

           $purviews = $db->fetchOne("SELECT f_purviews FROM " . $gDb['prefix'] . "admingroups WHERE (f_id='" . $arr['f_groupId'] . "')");

           $_SESSION['ses_adminId'] = $arr['f_id'];

           $_SESSION['ses_adminName'] = $userName;

           $_SESSION['ses_adminPurviews'] = $purviews;

           

           header("location: ./");

           exit();

       }

       else

       {

           $tpl->assign("msg", "用户不存在，或是密码错误。");