jonasled2/website
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge branch 'jonasled-master-patch-15565' into 'master'

Browse source 
fix two times sql injection possible

See merge request jonasled/website!10
This commit is contained in:
Jonas Leder 2022-03-16 10:18:52 +01:00
parent b4371f8db4 9c236bba83
commit 2d063cf0f1
3 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
public/API/queries/blogPost.php
View file

@ -39,6 +39,7 @@ function blogPost($id, $conn)
function blogPosts($count, $contentLength, $conn)
{
$response = [];
$count = $conn->real_escape_string($count);
$result = $conn->query("SELECT * FROM posts order by id desc limit $count");
if ($result->num_rows > 0) {
while ($row = $result->fetch_assoc()) {
@ -62,4 +63,4 @@ function blogPosts($count, $contentLength, $conn)
}
return $response;
}
}

1
public/API/queries/comments.php
View file

@ -18,6 +18,7 @@ $commentField = new ObjectType([
function comments($article, $conn)
{
$response = [];
$article = $conn->real_escape_string($article);
$result = $conn->query("SELECT * FROM comments WHERE article='$article'");
while ($row = $result->fetch_assoc()) {
$commentElement = [

2
public/API/queries/skills.php
View file

@ -20,4 +20,4 @@ function getSkills() {
array_push($response, $skill["Key"]);
}
return $response;
}
}