tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Use bound parameters for every query that takes user data.

Browse Source 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
This commit is contained in:
tim
2026-09-25 21:29:09 +02:00
parent cda0602c95
commit c85f54116c
7 changed files with 70 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
display.php
+2 -2
View File
@@ -41,8 +41,8 @@ function display_img($id) {
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
}
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ".$db->real_escape_string($id).$hidden." LIMIT 0, 1";
$result = $db->query($query)or die("Query failed : ".$db->error);
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
$result = $db->execute_query($query, array((int)$id)) or die("Query failed : ".$db->error);
$row = $result->fetch_assoc();
if ($row) {