Changeset 22

Timestamp:

Dec 26, 2018, 12:09:50 PM (6 years ago)

Author:

chronos

Message:

• Fixed: SQL injection protection.

File:

• trunk/index.php (modified) (2 diffs)

trunk/index.php

@@ -123 +123 @@
   {
     $Output = '';
-    //print_r($_GET);
     if (array_key_exists('lvm', $_GET) and ($_GET['lvm'] == 'seznam'))
     {
@@ -243 +242 @@
 
     $Where = '';
-    if (array_key_exists('name', $_SESSION) and ($_SESSION['name'] != '')) $Where .= ' AND (Name LIKE "%'.$_SESSION['name'].'%")';
-    if (array_key_exists('location', $_SESSION) and ($_SESSION['location'] != '')) $Where .= ' AND (Location LIKE "%'.$_SESSION['location'].'%")';
-    if (array_key_exists('message', $_SESSION) and ($_SESSION['message'] != '')) $Where .= ' AND (Message LIKE "%'.$_SESSION['message'].'%")';
-    if (array_key_exists('vekod', $_SESSION) and ($_SESSION['vekod'] != '')) $Where .= ' AND (Age >= '.$_SESSION['vekod'].')';
-    if (array_key_exists('vekdo', $_SESSION) and ($_SESSION['vekdo'] != '')) $Where .= ' AND (Age <= '.$_SESSION['vekdo'].')';
-    if (array_key_exists('vyskaod', $_SESSION) and ($_SESSION['vyskaod'] != '')) $Where .= ' AND (Height >= '.$_SESSION['vyskaod'].')';
-    if (array_key_exists('vyskado', $_SESSION) and ($_SESSION['vyskado'] != '')) $Where .= ' AND (Height <= '.$_SESSION['vyskado'].')';
-    if (array_key_exists('vahaod', $_SESSION) and ($_SESSION['vahaod'] != '')) $Where .= ' AND (Weight >= '.$_SESSION['vahaod'].')';
-    if (array_key_exists('vahado', $_SESSION) and ($_SESSION['vahado'] != '')) $Where .= ' AND (Weight <= '.$_SESSION['vahado'].')';
-    if (array_key_exists('pohlavi', $_SESSION) and ($_SESSION['pohlavi'] != '')) $Where .= ' AND (Gender = '.$_SESSION['pohlavi'].')';
+    if (array_key_exists('name', $_SESSION) and ($_SESSION['name'] != '')) $Where .= ' AND (Name LIKE "%'.$this->Database->real_escape_string($_SESSION['name']).'%")';
+    if (array_key_exists('location', $_SESSION) and ($_SESSION['location'] != '')) $Where .= ' AND (Location LIKE "%'.$this->Database->real_escape_string($_SESSION['location']).'%")';
+    if (array_key_exists('message', $_SESSION) and ($_SESSION['message'] != '')) $Where .= ' AND (Message LIKE "%'.$this->Database->real_escape_string($_SESSION['message']).'%")';
+    if (array_key_exists('vekod', $_SESSION) and ($_SESSION['vekod'] != '')) $Where .= ' AND (Age >= '.$this->Database->real_escape_string($_SESSION['vekod']).')';
+    if (array_key_exists('vekdo', $_SESSION) and ($_SESSION['vekdo'] != '')) $Where .= ' AND (Age <= '.$this->Database->real_escape_string($_SESSION['vekdo']).')';
+    if (array_key_exists('vyskaod', $_SESSION) and ($_SESSION['vyskaod'] != '')) $Where .= ' AND (Height >= '.$this->Database->real_escape_string($_SESSION['vyskaod']).')';
+    if (array_key_exists('vyskado', $_SESSION) and ($_SESSION['vyskado'] != '')) $Where .= ' AND (Height <= '.$this->Database->real_escape_string($_SESSION['vyskado']).')';
+    if (array_key_exists('vahaod', $_SESSION) and ($_SESSION['vahaod'] != '')) $Where .= ' AND (Weight >= '.$this->Database->real_escape_string($_SESSION['vahaod']).')';
+    if (array_key_exists('vahado', $_SESSION) and ($_SESSION['vahado'] != '')) $Where .= ' AND (Weight <= '.$this->Database->real_escape_string($_SESSION['vahado']).')';
+    if (array_key_exists('pohlavi', $_SESSION) and ($_SESSION['pohlavi'] != '')) $Where .= ' AND (Gender = '.$this->Database->real_escape_string($_SESSION['pohlavi']).')';
     if (substr($Where, 0, 4) == ' AND') $Where = substr($Where, 4);
     if ($Where == '') $Where = '1';