CVE-2017-14069

burpheart · Aug 14, 2020 · 0962224 · 0962224
1 parent 2197930
commit 0962224
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nowarn.php b/nowarn.php
@@ -24,7 +24,7 @@ function bark($msg) {
 $userid = implode(", ", $_POST[usernw]);
 //sql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
 
-$r = sql_query("SELECT modcomment FROM users WHERE id IN (" . implode(", ", $_POST[usernw]) . ")")or sqlerr(__FILE__, __LINE__);
+$r = sql_query("SELECT modcomment FROM users WHERE id IN (" . sqlesc(implode(", ", $_POST[usernw]) ). ")")or sqlerr(__FILE__, __LINE__);
 $user = mysql_fetch_array($r);
 $exmodcomment = $user["modcomment"];
 $modcomment = date("Y-m-d") . " - Warning Removed By " . $CURUSER['username'] . ".\n". $modcomment . $exmodcomment;