prepared sql

joomla · Jul 3, 2019 · 047d1a8 · 047d1a8
1 parent f80eaba
commit 047d1a8
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/administrator/components/com_redirect/Model/LinkModel.php b/administrator/components/com_redirect/Model/LinkModel.php
@@ -168,10 +168,12 @@ public function activate(&$pks, $url, $comment = null)
 			// Update the link rows.
 			$query = $db->getQuery(true)
 				->update($db->quoteName('#__redirect_links'))
-				->set($db->quoteName('new_url') . ' = ' . $db->quote($url))
+				->set($db->quoteName('new_url') . ' = :url')
 				->set($db->quoteName('published') . ' = ' . (int) 1)
-				->set($db->quoteName('comment') . ' = ' . $db->quote($comment))
-				->where($db->quoteName('id') . ' IN (' . implode(',', $pks) . ')');
+				->set($db->quoteName('comment') . ' = :comment')
+				->whereIn($db->quoteName('id'), $pks)
+				->bind(':url', $url)
+				->bind(':comment', $comment);
 			$db->setQuery($query);
 
 			try
@@ -225,10 +227,12 @@ public function duplicateUrls(&$pks, $url, $comment = null)
 			// Update the link rows.
 			$query = $db->getQuery(true)
 				->update($db->quoteName('#__redirect_links'))
-				->set($db->quoteName('new_url') . ' = ' . $db->quote($url))
-				->set($db->quoteName('modified_date') . ' = ' . $db->quote($date))
+				->set($db->quoteName('new_url') . ' = :url')
+				->set($db->quoteName('modified_date') . ' = :date')
 				->set($db->quoteName('published') . ' = ' . 1)
-				->where($db->quoteName('id') . ' IN (' . implode(',', $pks) . ')');
+				->whereIn($db->quoteName('id'), $pks)
+				->bind(':url', $url)
+				->bind(':date', $date);
 
 			if (!empty($comment))
 			{