SQL injection attack possiblity

[toddejohnson]

There's a SQL Injection possiblity because $_GET['report'] isn't validated to be numeric or escaped.

echo tmpl_page( ""
    .tmpl_reportList($allowed_reports)
    .tmpl_reportData( (isset($_GET["report"]) ? $_GET["report"] : false ), $allowed_reports )
);
if (!$reportnumber) {
    return "";
}
$sql = "SELECT * FROM rptrecord where serial = $reportnumber";

I'd suggest adding validation:

if(isset($_GET['report']) && is_numeric($_GET['report'])){
        $reportid=$_GET['report'];
}elseif(!isset($_GET['report'])){
        $reportid=false;
}else{
        die('Invalid Report ID');
}
// Generate Page with report list and report data (if a report is selected).
echo tmpl_page( ""
        .tmpl_reportList($allowed_reports)
        .tmpl_reportData( $reportid, $allowed_reports )
);

Patch attached.
dmarcts-report-viewer.txt

[techsneeze]

Thanks for the suggestion and the patch! The patch has been applied and posted!