Clean and protect get_sondage_from_id function

leblanc-simon · May 14, 2011 · 2dd5ce6 · 2dd5ce6
1 parent 475556c
commit 2dd5ce6
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/fonctions.php b/fonctions.php
@@ -66,9 +66,16 @@ function get_sondage_from_id($id) {
   global $connect;
   // Ouverture de la base de données
   if(preg_match(";^[\w\d]{16}$;i",$id)) {
-    $sondage=$connect->Execute("SELECT sondage.*,sujet_studs.sujet FROM sondage".
-			       " LEFT OUTER JOIN sujet_studs ON sondage.id_sondage = sujet_studs.id_sondage".
-			       " WHERE sondage.id_sondage = $id");
+    $sql = 'SELECT sondage.*,sujet_studs.sujet FROM sondage
+	    LEFT OUTER JOIN sujet_studs ON sondage.id_sondage = sujet_studs.id_sondage
+	    WHERE sondage.id_sondage = '.$connect->Param('id_sondage');
+    $sql = $connect->Prepare($sql);
+    $sondage=$connect->Execute($sql, array($id));
+
+    if ($sondage === false) {
+      return false;
+    }
+
     $psondage = $sondage->FetchObject(false);
     $psondage->date_fin = strtotime($psondage->date_fin);
     return $psondage;