Fixed a SQL injection

17 years ago · 7bfa208a4e
parent df42c88a5b
commit 7bfa208a4e
1 changed files with 1 additions and 1 deletions
--- a/pages/account/28.php
+++ b/pages/account/28.php
@ -13,7 +13,7 @@
    PARTICULAR PURPOSE.  See the License for more details.
 */ ?>
 <?
-	$query = "select * from `orginfo` where `id`='".$_REQUEST[orgid]."'";
+	$query = "select * from `orginfo` where `id`='".intval($_REQUEST[orgid])."'";
 	$row = mysql_fetch_assoc(mysql_query($query));
 ?>
 <form method="post" action="account.php">