浏览代码

Security: Adding intval in query

Julio Montoya 13 年之前
父节点
当前提交
ab36f087a7
共有 2 个文件被更改,包括 2 次插入0 次删除
  1. 1 0
      main/inc/lib/database.lib.php
  2. 1 0
      main/inc/lib/database.mysqli.lib.php

+ 1 - 0
main/inc/lib/database.lib.php

@@ -274,6 +274,7 @@ class Database {
      * @todo move this function in a gradebook-related library
      */
     public static function get_course_by_category($category_id) {
+        $category_id = intval($category_id);
         $info = self::fetch_array(self::query('SELECT course_code FROM '.self::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY).' WHERE id='.$category_id), 'ASSOC');
         return $info ? $info['course_code'] : false;
     }

+ 1 - 0
main/inc/lib/database.mysqli.lib.php

@@ -262,6 +262,7 @@ class Database {
      * @todo move this function in a gradebook-related library
      */
     public static function get_course_by_category($category_id) {
+        $category_id = intval($category_id);
         $info = self::fetch_array(self::query('SELECT course_code FROM '.self::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY).' WHERE id='.$category_id), 'ASSOC');
         return $info ? $info['course_code'] : false;
     }