Explorar el Código

Security: Adding intval in query

Julio Montoya hace 13 años
padre
commit
ab36f087a7
Se han modificado 2 ficheros con 2 adiciones y 0 borrados
  1. 1 0
      main/inc/lib/database.lib.php
  2. 1 0
      main/inc/lib/database.mysqli.lib.php

+ 1 - 0
main/inc/lib/database.lib.php

@@ -274,6 +274,7 @@ class Database {
      * @todo move this function in a gradebook-related library
      */
     public static function get_course_by_category($category_id) {
+        $category_id = intval($category_id);
         $info = self::fetch_array(self::query('SELECT course_code FROM '.self::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY).' WHERE id='.$category_id), 'ASSOC');
         return $info ? $info['course_code'] : false;
     }

+ 1 - 0
main/inc/lib/database.mysqli.lib.php

@@ -262,6 +262,7 @@ class Database {
      * @todo move this function in a gradebook-related library
      */
     public static function get_course_by_category($category_id) {
+        $category_id = intval($category_id);
         $info = self::fetch_array(self::query('SELECT course_code FROM '.self::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY).' WHERE id='.$category_id), 'ASSOC');
         return $info ? $info['course_code'] : false;
     }