claunia/qemudb
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use query_parameters() in SQL select, update and delete statements to protect against

Browse Source 
sql injection attacks
This commit is contained in:
Chris Morgan
2006-06-27 19:16:27 +00:00
committed by WineHQ
parent e6458694f4
commit e3f9e5371a
46 changed files with 602 additions and 484 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
viewbugs.php
View File

@@ -29,17 +29,17 @@ if( !is_numeric($aClean['bug_id']))
echo '</tr>',"\n";
$sQuery = "SELECT appFamily.description as appDescription,
appFamily.appName as appName,
appVersion.*, buglinks.versionId as versionId
FROM appFamily, appVersion, buglinks
WHERE appFamily.appId = appVersion.appId
and buglinks.versionId = appVersion.versionId
AND buglinks.bug_id = ".$aClean['bug_id']."
ORDER BY versionName";
$hResult = query_parameters("SELECT appFamily.description as appDescription,
appFamily.appName as appName,
appVersion.*, buglinks.versionId as versionId
FROM appFamily, appVersion, buglinks
WHERE appFamily.appId = appVersion.appId
and buglinks.versionId = appVersion.versionId
AND buglinks.bug_id = '?'
ORDER BY versionName", $aClean['bug_id']);
$c = 0;
if($hResult = query_appdb($sQuery))
if($hResult)
{
while($oRow = mysql_fetch_object($hResult))
{