cacert
/
cacert-webdb
9
0
Fork 0
Code Issues Pull Requests 5 Projects Releases 3 Wiki Activity

Added SQL-Injection Protection

Browse Source
pull/1/head
root 16 years ago
parent 6e96aa01aa
commit f31073f49d
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File

14
includes/account.php
Unescape Escape View File

@ -2624,21 +2624,21 @@
if($oldid == 50 && $process != "")
{
$_REQUEST['userid'] = intval($_REQUEST['userid']);
$res = mysql_query("select * from `users` where `id`='".$_REQUEST['userid']."'");
$res = mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'");
if(mysql_num_rows($res) > 0)
{
$query = "update `domaincerts`,`domains` SET `domaincerts`.`revoked`='1970-01-01 10:00:01'
WHERE `domaincerts`.`domid` = `domains`.`id` AND `domains`.`memid`='".$_REQUEST['userid']."'";
WHERE `domaincerts`.`domid` = `domains`.`id` AND `domains`.`memid`='".intval($_REQUEST['userid'])."'";
mysql_query($query);
$query = "update `domains` SET `deleted`=NOW() WHERE `domains`.`memid`='".$_REQUEST['userid']."'";
$query = "update `domains` SET `deleted`=NOW() WHERE `domains`.`memid`='".intval($_REQUEST['userid'])."'";
mysql_query($query);
$query = "update `emailcerts` SET `revoked`='1970-01-01 10:00:01' WHERE `memid`='".$_REQUEST['userid']."'";
$query = "update `emailcerts` SET `revoked`='1970-01-01 10:00:01' WHERE `memid`='".intval($_REQUEST['userid'])."'";
mysql_query($query);
$query = "update `email` SET `deleted`=NOW() WHERE `memid`='".$_REQUEST['userid']."'";
$query = "update `email` SET `deleted`=NOW() WHERE `memid`='".intval($_REQUEST['userid'])."'";
mysql_query($query);
$query = "delete from `org` WHERE `memid`='".$_REQUEST['userid']."'";
$query = "delete from `org` WHERE `memid`='".intval($_REQUEST['userid'])."'";
mysql_query($query);
$query = "update `users` SET `deleted`=NOW() WHERE `id`='".$_REQUEST['userid']."'";
$query = "update `users` SET `deleted`=NOW() WHERE `id`='".intval($_REQUEST['userid'])."'";
mysql_query($query);
}
}

Write Preview
Loading…
Cancel
Save