Browse Source

Security: Adding intval in query

Julio Montoya 13 năm trước cách đây
mục cha
commit
ab36f087a7
2 tập tin đã thay đổi với 2 bổ sung0 xóa
  1. 1 0
      main/inc/lib/database.lib.php
  2. 1 0
      main/inc/lib/database.mysqli.lib.php

+ 1 - 0
main/inc/lib/database.lib.php

@@ -274,6 +274,7 @@ class Database {
      * @todo move this function in a gradebook-related library
      */
     public static function get_course_by_category($category_id) {
+        $category_id = intval($category_id);
         $info = self::fetch_array(self::query('SELECT course_code FROM '.self::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY).' WHERE id='.$category_id), 'ASSOC');
         return $info ? $info['course_code'] : false;
     }

+ 1 - 0
main/inc/lib/database.mysqli.lib.php

@@ -262,6 +262,7 @@ class Database {
      * @todo move this function in a gradebook-related library
      */
     public static function get_course_by_category($category_id) {
+        $category_id = intval($category_id);
         $info = self::fetch_array(self::query('SELECT course_code FROM '.self::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY).' WHERE id='.$category_id), 'ASSOC');
         return $info ? $info['course_code'] : false;
     }