那user.php举个例子，从上往下看
第一个问题：
<?php
$smarty->assign('step', $_REQUEST['act']);
$smarty->assign('id', $_REQUEST['id']);
$smarty->assign('best_goods', recommend_goods('best'));
$smarty->assign('new_goods', recommend_goods('new'));
$smarty->assign('hot_goods', recommend_goods('hot'));
$smarty->assign('promotion_goods', recommend_goods('promote'));
?>
不如：
<?php
$smarty->assign(array(
'step'=>$_REQUEST['act']),
'id'=>$_REQUEST['id']),
'best_goods'=>recommend_goods('best'),
'new_goods'=>recommend_goods('new'),
'hot_goods'=>recommend_goods('hot'),
'promotion_goods'=>recommend_goods('promote'));
?>
第二个问题：
<?php
$sql = "INSERT INTO ".$ecs->table('feedback'). " (user_id,user_name,user_email,msg_title,msg_type,msg_content,msg_time,message_img) ".
" VALUES ('".$_SESSION['user_id']."', '".$_SESSION['user_name']."', '".$_SESSION['email']."', '".$msg_title."', '".$_POST['msg_type']."', '".$msg_content."', '".time()."', '".$img_name."')";
if ($db->Execute($sql))
{
header("Location: user.php?act=messagen");
exit;
}
else
{
die($db->ErrorMsg());
}
?>
这里面有两个问题(1)用.连接多个字符串效率是相对低下的，不如使用sprintf；(2)变量$sql只使用了一次，却无畏的定义了一个变量，以上不如：
<?php
if ($db->Execute(sprintf("INSERT INTO %s (user_id,user_name,user_email,msg_title,msg_type,msg_content,msg_time,message_img)<img src="">VALUES ('%s','%s','%s','%s','%s','%s','%s','%s')",$ecs->table('feedback'),$_SESSION['user_id'],$_SESSION['user_name'],$_SESSION['email'],$msg_title,$_POST['msg_type'],$msg_content,time(),$img_name)))
?>
第三个问题：
<?php
$sql = "UPDATE ".$GLOBALS['ecs']->table('user_address'). " SET ".
"consignee = '".trim($_POST['consignee'.$sn])."', ".
"email = '".$_POST['email'.$sn]."', ".
"country = '".$_POST['country'.$sn]."', ".
"province = '".$_POST['province'.$sn]."', ".
"city = '".$_POST['city'.$sn]."', ".
"district = '".$_POST['district'.$sn]."', ".
"address = '".trim($_POST['address'.$sn])."', ".
"zipcode = '".$zipcode."', ".
"tel = '".$tel."', ".
"mobile = '".$mobile."', ".
"sign_building = '".$sign_building ."', ".
"best_time = '".$best_time."' ".
"WHERE address_id = '".$address_id."'";
$result = $GLOBALS['db']->Execute($sql) or die($GLOBALS['db']->ErrorMsg());
?>
除了以上的问题，这里仍然有两个问题
(1)$GLOBALS的使用有问题，可能是架构的设计上出现了问题，倒是$GLOBALS的过渡使用，不管是效率还是可读性方面都是让人难以忍受的。(2)没有对输入数据进行过滤；
粗略的看了几个文件，以上的几个问题出现的频率是非常高的，希望作者予以考虑。
