claunia/qemudb
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use query_parameters() in SQL select, update and delete statements to protect against

Browse Source 
sql injection attacks
This commit is contained in:
Chris Morgan
2006-06-27 19:16:27 +00:00
committed by WineHQ
parent e6458694f4
commit e3f9e5371a
46 changed files with 602 additions and 484 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
include/tableve.php
View File

@@ -173,7 +173,8 @@ class TableVE {
function make_option_list($varname, $cvalue, $table, $idField, $nameField, $where = "")
{
$hResult = query_appdb("SELECT $idField, $nameField FROM $table $where ORDER BY $nameField");
$hResult = query_parameters("SELECT ?, ? FROM ? ? ORDER BY '?'",
$idField, $nameField, $table, $where, $nameField);
if(!$hResult)
return; // Oops
@@ -442,7 +443,8 @@ class TableVE {
if(ereg("^impl_.+$", $table))
{
$value = $fieldnames["apiid"][$i];
query_appdb("UPDATE $table SET lastmodby = ".$_SESSION['current']->userid." WHERE apiid = $value");
query_parameters("UPDATE ? SET lastmodby = '?' WHERE apiid = '?'",
$table, $_SESSION['current']->iUserId, $value);
}
}
}