diff options
| author | Dan McGee <dan@archlinux.org> | 2011-04-25 23:23:01 -0500 |
|---|---|---|
| committer | Lukas Fleischer <archlinux@cryptocrack.de> | 2011-04-27 14:50:27 +0200 |
| commit | 3609cf140eaca30878d0a69fba0d837b4fec41a0 (patch) | |
| tree | 5132be13c5b5afb70c7d281c6220f9fb5cbbcf2a /web/html/passreset.php | |
| parent | fcda6671f3021273844f7898c7cfec1e99df8ec2 (diff) | |
| download | aurweb-3609cf140eaca30878d0a69fba0d837b4fec41a0.tar.xz | |
SQL: treat all UID/ID values as numbers, not strings
Ensure we are not quoting these values in any of our SQL queries.
Thanks-to: elij <elij.mx@gmail.com>
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/html/passreset.php')
| -rw-r--r-- | web/html/passreset.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/web/html/passreset.php b/web/html/passreset.php index 2c7801d..0ce6f7d 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -58,8 +58,8 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir $resetkey = new_sid(); $dbh = db_connect(); $q = "UPDATE Users - SET ResetKey = '$resetkey' - WHERE ID = '$uid'"; + SET ResetKey = '" . $resetkey . "' + WHERE ID = " . $uid; db_query($q, $dbh); # Send email with confirmation link $body = __('A password reset request was submitted for the account '. |