**
* 登录
* @param type $email
* @param type $password
* @return boolean
*/
public function doLogin($email, $password) {

$t_memberModel = M("Member");
$user = $t_memberModel->where(array(
'username' => $email,
'userpass' => md5($password),
))->buildsql();


$email 传的参数bulidsql 出来 可以注入单引号，，，，，网站主站的asp.net的数据库挂了。。。泪奔啊。