Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix SQLi in settings::save_all() Closes #680
  • Loading branch information
rjmackay committed Jul 6, 2012
1 parent d954093 commit 4764792
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions application/models/settings.php
Expand Up @@ -102,6 +102,9 @@ public static function save_all(Validation $settings)
$values = array();
$keys = array();

// Modification date
$settings['date_modify'] = date("Y-m-d H:i:s",time());

// List of value to skip
$skip = array('api_live');
foreach ($settings as $key => $value)
Expand All @@ -116,19 +119,17 @@ public static function save_all(Validation $settings)
{
$value = NULL;
}


$keys[] = sprintf("'%s'", $key);
$values[] = sprintf("WHEN '%s' THEN '%s' ", $key, $value);
$keys[] = Database::instance()->escape($key);
$values[] = sprintf("WHEN %s THEN %s ", Database::instance()->escape($key), Database::instance()->escape($value));
}

// Modification date
$keys[] = "'date_modify'";
$values[] = sprintf("WHEN 'date_modify' THEN '%s' ", date("Y-m-d H:i:s",time()));

// Construct the final query
$query .= implode(" ", $values)."END WHERE `key` IN (%s)";
$query = sprintf($query, implode(",", $keys));


// Performa batch update
Database::instance()->query($query);
}
Expand Down

0 comments on commit 4764792

Please sign in to comment.