Prevent blind SQL injection

The fight lives on
symphonycms · Aug 7, 2017 · de98edd · de98edd
1 parent 81508c0
commit de98edd
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/symphony/lib/toolkit/class.sectionmanager.php b/symphony/lib/toolkit/class.sectionmanager.php
@@ -215,6 +215,7 @@ public static function fetch($section_id = null, $order = 'ASC', $sortfield = 'n
      */
     public static function fetchIDFromHandle($handle)
     {
+        $handle = Symphony::Database()->cleanValue($handle);
         return Symphony::Database()->fetchVar('id', 0, "SELECT `id` FROM `tbl_sections` WHERE `handle` = '$handle' LIMIT 1");
     }