SQL injection exists in multiple interfaces of the system

[fiblue]

1.The system directly concatenates SQL statements based on the passed parameters
src/main/java/cn/javaex/yaoqishan/action/media_info/MediaInfoAction.java


2.Time delay injection test
A long wait for a response after the request is issued indicates that the sleep() function is in effect