Changeset 8613

Timestamp:

01/14/10 22:00:04 (3 years ago)

Author:

p_lindheimer

Message:

sanatize cidnum to avoid potential SQL Injections

Files:

• modules/branches/2.6/core/functions.inc.php (modified) (2 diffs)

modules/branches/2.6/core/functions.inc.php

@@ -2475 +2475 @@
-
-function core_did_get($extension="",$cidnum=""){
+  $cidnum = $db->escapeSimple($cidnum);
-  $sql = "SELECT * FROM incoming WHERE cidnum = \"$cidnum\" AND extension = \"$extension\"";
-  return sql($sql,"getRow",DB_FETCHMODE_ASSOC);
@@ -2480 +2481 @@
-
-function core_did_del($extension,$cidnum){
+  $cidnum = $db->escapeSimple($cidnum);
-  $sql="DELETE FROM incoming WHERE cidnum = \"$cidnum\" AND extension = \"$extension\"";
-  sql($sql);