Skip to content

Commit

Permalink
Ensure SelectLimit $nrows and`$offset parameters are integers
Browse files Browse the repository at this point in the history
The same is done (at least for `$nrows`) in the `SelectLimit` method of `Adodb/adodb.inc.php`.

This lowers the risk of SQL injection.

Fixes ADOdb#311

(cherry picked from commit 7d43989)
  • Loading branch information
dregad committed Mar 30, 2018
1 parent 1a71d72 commit 34788ce
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions drivers/adodb-pdo_mysql.inc.php
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,8 @@ function SelectDB($dbName)
// parameters use PostgreSQL convention, not MySQL
function SelectLimit($sql, $nrows=-1, $offset=-1, $inputarr=false, $secs=0)
{
$nrows = (int) $nrows;
$offset = (int) $offset;
$offsetStr =($offset>=0) ? "$offset," : '';
// jason judge, see http://phplens.com/lens/lensforum/msgs.php?id=9220
if ($nrows < 0) {
Expand Down

0 comments on commit 34788ce

Please sign in to comment.