From 3609cf140eaca30878d0a69fba0d837b4fec41a0 Mon Sep 17 00:00:00 2001 From: Dan McGee Date: Mon, 25 Apr 2011 23:23:01 -0500 Subject: SQL: treat all UID/ID values as numbers, not strings Ensure we are not quoting these values in any of our SQL queries. Thanks-to: elij Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer --- web/html/pkgsubmit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'web/html/pkgsubmit.php') diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index f2777b7..26608ea 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -325,7 +325,7 @@ if ($uid): } # Update package data - $q = sprintf("UPDATE Packages SET ModifiedTS = UNIX_TIMESTAMP(), Name = '%s', Version = '%s-%s', License = '%s', Description = '%s', URL = '%s', OutOfDateTS = NULL, MaintainerUID = '%d' WHERE ID = %d", + $q = sprintf("UPDATE Packages SET ModifiedTS = UNIX_TIMESTAMP(), Name = '%s', Version = '%s-%s', License = '%s', Description = '%s', URL = '%s', OutOfDateTS = NULL, MaintainerUID = %d WHERE ID = %d", mysql_real_escape_string($new_pkgbuild['pkgname']), mysql_real_escape_string($new_pkgbuild['pkgver']), mysql_real_escape_string($new_pkgbuild['pkgrel']), -- cgit v1.2.3-70-g09d2