Merge branch 'jonasled-master-patch-15565' into 'master'
fix two times sql injection possible See merge request jonasled/website!10
This commit is contained in:
commit
2d063cf0f1
3 changed files with 4 additions and 2 deletions
|
@ -39,6 +39,7 @@ function blogPost($id, $conn)
|
||||||
function blogPosts($count, $contentLength, $conn)
|
function blogPosts($count, $contentLength, $conn)
|
||||||
{
|
{
|
||||||
$response = [];
|
$response = [];
|
||||||
|
$count = $conn->real_escape_string($count);
|
||||||
$result = $conn->query("SELECT * FROM posts order by id desc limit $count");
|
$result = $conn->query("SELECT * FROM posts order by id desc limit $count");
|
||||||
if ($result->num_rows > 0) {
|
if ($result->num_rows > 0) {
|
||||||
while ($row = $result->fetch_assoc()) {
|
while ($row = $result->fetch_assoc()) {
|
||||||
|
|
|
@ -18,6 +18,7 @@ $commentField = new ObjectType([
|
||||||
function comments($article, $conn)
|
function comments($article, $conn)
|
||||||
{
|
{
|
||||||
$response = [];
|
$response = [];
|
||||||
|
$article = $conn->real_escape_string($article);
|
||||||
$result = $conn->query("SELECT * FROM comments WHERE article='$article'");
|
$result = $conn->query("SELECT * FROM comments WHERE article='$article'");
|
||||||
while ($row = $result->fetch_assoc()) {
|
while ($row = $result->fetch_assoc()) {
|
||||||
$commentElement = [
|
$commentElement = [
|
||||||
|
|
Loading…
Reference in a new issue