claunia/qemudb
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protect against sql injection attacks in sql INSERT statements

Browse Source
This commit is contained in:
Chris Morgan
2006-06-24 04:20:32 +00:00
committed by WineHQ
parent c31173ef9e
commit fb0f3b5dd3
20 changed files with 208 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
include/comment.php
View File

@@ -53,15 +53,12 @@ class Comment {
*/
function create($sSubject, $sBody, $iParentId=null, $iVersionId)
{
$aInsert = compile_insert_string(array( 'parentId' => $iParentId,
'versionId' => $iVersionId,
'subject' => $sSubject,
'body' => $sBody ));
$hResult = query_parameters("INSERT INTO appComments (parentId, versionId, subject, ".
"body, userId, time, hostname) VALUES ('?', '?', '?', '?', '?', ?, '?')",
$iParentId, $iVersionId, $sSubject, $sBody, $_SESSION['current']->iUserId,
"NOW()", get_remote());
$sFields = "({$aInsert['FIELDS']}, `userId`, `time`, `hostname`)";
$sValues = "({$aInsert['VALUES']}, ".$_SESSION['current']->iUserId.", NOW(), '".get_remote()."')";
if(query_appdb("INSERT INTO appComments $sFields VALUES $sValues", "Error while creating a new comment."))
if($hResult)
{
$this->comment(mysql_insert_id());
$sEmail = get_notify_email_address_list($this->iAppId, $this->iVersionId);
@@ -101,7 +98,10 @@ class Comment {
return true;
}
else
{
addmsg("Error while creating a new comment", "red");
return false;
}
}