SQL Injection in $_GET['dni_profe'] - "config/cargos.php"

Filters for SQL Injection in $_GET['dni_profe']
mpedraza2020 · Dec 18, 2019 · 678190b · 678190b
1 parent 5e62749
commit 678190b
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/config/cargos.php b/config/cargos.php
@@ -13,7 +13,8 @@
 
 	<?php
 	if ($_GET['borrar']=='1') {
-		mysqli_query($db_con, "delete from departamentos where dni = '".$_GET['dni_profe']."'");
+		$dni_profe = preg_replace('([^A-Za-z0-9])', '', $_GET['dni_profe']);
+		mysqli_query($db_con, "delete from departamentos where dni = '".$dni_profe."'");
 		echo '<div class="alert alert-success">
 	            <button type="button" class="close" data-dismiss="alert">&times;</button>
 	            El profesor ha sido borrado de la base de datos..