Skip to content

Commit

Permalink
FIX SQL Injection Vulnerabilities following report by pm_security_report
Browse files Browse the repository at this point in the history
  • Loading branch information
@luckyshot
luckyshot committed Nov 22, 2022
1 parent e558563 commit 8c62d27
Showing 1 changed file with 16 additions and 16 deletions.
32 changes: 16 additions & 16 deletions index.php
View file
Expand Up @@ -212,7 +212,7 @@ function search($s='') {
foreach ($w as &$wi) {
$wi = "(name LIKE '%".$c->real_escape_string($wi)."%' OR form LIKE '%".$c->real_escape_string($wi)."%' OR comments LIKE '%".$c->real_escape_string($wi)."%') ";
}
$q = "SELECT id, name, form FROM ".$_SESSION['dbprefix']."people WHERE ". implode(' AND ', $w) ." ORDER BY name ASC LIMIT 0, 50";
$q = "SELECT `id`, `name`, `form` FROM `".$_SESSION['dbprefix']."people` WHERE ". implode(' AND ', $w) ." ORDER BY `name` ASC LIMIT 0, 50";
$people = db($q, $c);

foreach($people as &$person) {
Expand Down Expand Up @@ -247,9 +247,9 @@ function get($detail) {
}else{
global $c;
if (is_numeric($detail)) {
$people = db("SELECT * FROM ".$_SESSION['dbprefix']."people WHERE id = ".$c->real_escape_string($detail)." LIMIT 1", $c);
$people = db("SELECT * FROM `".$_SESSION['dbprefix']."people` WHERE `id` = '".$c->real_escape_string($detail)."' LIMIT 1;", $c);
}else{
$people = db("SELECT * FROM ".$_SESSION['dbprefix']."people WHERE name LIKE '%".$c->real_escape_string($detail)."%' OR form LIKE '%".$c->real_escape_string($detail)."%' ORDER BY updated DESC LIMIT 1", $c);
$people = db("SELECT * FROM `".$_SESSION['dbprefix']."people` WHERE `name` LIKE '%".$c->real_escape_string($detail)."%' OR `form` LIKE '%".$c->real_escape_string($detail)."%' ORDER BY `updated` DESC LIMIT 1;", $c);
}
if ($people) {
$people = $people[0];
Expand Down Expand Up @@ -297,12 +297,12 @@ function save() {
}
//var_dump($array);
if ($_POST['id']) { // update details
$q = "UPDATE ".$_SESSION['dbprefix']."people SET
form = '".$c->real_escape_string(json_encode($array))."',
name = '".$c->real_escape_string($_POST['name'])."',
`updated` = '".time()."' WHERE id = ".($_POST['id']).";";
$q = "UPDATE `".$_SESSION['dbprefix']."people` SET
`form` = '".$c->real_escape_string(json_encode($array))."',
`name` = '".$c->real_escape_string($_POST['name'])."',
`updated` = '".time()."' WHERE `id` = '".$c->real_escape_string($_POST['id'])."';";
}else{ // create new
$q = "INSERT INTO ".$_SESSION['dbprefix']."people VALUES (
$q = "INSERT INTO `".$_SESSION['dbprefix']."people` VALUES (
NULL,
'".$c->real_escape_string($_POST['name'])."',
'".$c->real_escape_string(json_encode($array))."',
Expand All @@ -319,7 +319,7 @@ function save() {
$response = json(array('status'=>'success','message'=>'Contact details saved'));
}else{
// Get the ID
$q = "SELECT id from ".$_SESSION['dbprefix']."people ORDER BY id DESC LIMIT 1";
$q = "SELECT `id` FROM `".$_SESSION['dbprefix']."people` ORDER BY `id` DESC LIMIT 1;";
$id = db($q, $c);
$response = json(array('id'=>$id[0]['id'],'status'=>'success','message'=>'New contact created'));
}
Expand Down Expand Up @@ -348,7 +348,7 @@ function delete($id) {
$response = json(array('status'=>'error','message'=>"Your user cannot delete"));
}else{
global $c;
$deletion = db("DELETE FROM ".$_SESSION['dbprefix']."people WHERE id = ".$c->real_escape_string($id)."", $c);
$deletion = db("DELETE FROM `".$_SESSION['dbprefix']."people` WHERE `id` = '".$c->real_escape_string($id)."';", $c);

if ($deletion) {
$response = json(array('status'=>'success','message'=>'Contact deleted'));
Expand Down Expand Up @@ -386,7 +386,7 @@ function comment($id) {
json(array('status'=>'error','message'=>$lang['writecommentfirst']));
}else{
global $c;
$comments = db("SELECT comments FROM ".$_SESSION['dbprefix']."people WHERE id = ".$c->real_escape_string($_POST['id'])."", $c);
$comments = db("SELECT `comments` FROM `".$_SESSION['dbprefix']."people` WHERE id = '".$c->real_escape_string($_POST['id'])."';", $c);
$comments = json_decode($comments[0]['comments'], true);
//var_dump($comments);
array_unshift($comments, array(
Expand All @@ -395,7 +395,7 @@ function comment($id) {
'date' => date('c', time()), // iso 8601 format
'text' => $_POST['comment']
));
$q = "UPDATE ".$_SESSION['dbprefix']."people SET comments = '".$c->real_escape_string(json_encode($comments))."' WHERE id = ".$c->real_escape_string($_POST['id'])."";
$q = "UPDATE `".$_SESSION['dbprefix']."people` SET `comments` = '".$c->real_escape_string(json_encode($comments))."' WHERE `id` = '".$c->real_escape_string($_POST['id'])."';";
$result = db($q, $c);

if ($result) {
Expand All @@ -419,7 +419,7 @@ function commentdelete($id) {
}else{
global $c;
// load comments from person
$person = db("SELECT id,comments FROM ".$_SESSION['dbprefix']."people WHERE comments LIKE '%".$c->real_escape_string($id)."%' ORDER BY updated DESC LIMIT 1", $c);
$person = db("SELECT `id`, `comments` FROM `".$_SESSION['dbprefix']."people` WHERE `comments` LIKE '%".$c->real_escape_string($id)."%' ORDER BY `updated` DESC LIMIT 1;", $c);
$person[0]['comments'] = json_decode($person[0]['comments'], true);
// remove from array
foreach($person[0]['comments'] as $key => $comment) {
Expand All @@ -429,9 +429,9 @@ function commentdelete($id) {
}
}
// update person
$result = db("UPDATE ".$_SESSION['dbprefix']."people SET
comments = '".$c->real_escape_string(json_encode($person[0]['comments']))."'
WHERE id = ".($person[0]['id']).";", $c);
$result = db("UPDATE `".$_SESSION['dbprefix']."people` SET
`comments` = '".$c->real_escape_string(json_encode($person[0]['comments']))."'
WHERE `id` = '".($person[0]['id'])."';", $c);
if ($result) {
$response = json(array(
'status'=>'success',
Expand Down

0 comments on commit 8c62d27

Please sign in to comment.