gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 1953 [2/6]: refactoring SQL in C4::Koha::displayServers to use placeholders. 

The SQL call in displayServers was not using placeholders, leaving itself open
to potential SQL injection attacks. I've rewritten it to use placeholders.

Signed-off-by: Galen Charlton <galen.charlton@liblime.com>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
This commit is contained in:
Andrew Moore 2008-07-29 11:42:46 -05:00 committed by Joshua Ferraro
parent 4a4850b3cc
commit 9ecd632001
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
C4/Koha.pm
View File

@ -890,11 +890,22 @@ SELECT lib,
sub displayServers {
my ( $position, $type ) = @_;
my $dbh = C4::Context->dbh;
my $strsth = "SELECT * FROM z3950servers where 1";
$strsth .= " AND position=\"$position\"" if ($position);
$strsth .= " AND type=\"$type\"" if ($type);
my @bind_params;
if ( $position ) {
push @bind_params, $position;
$strsth .= ' AND position = ? ';
}
if ( $type ) {
push @bind_params, $type;
$strsth .= ' AND type = ? ';
}
my $rq = $dbh->prepare($strsth);
$rq->execute;
$rq->execute( @bind_params );
my @primaryserverloop;
while ( my $data = $rq->fetchrow_hashref ) {