git.gnu.io has moved to IP address 209.51.188.249 -- please double check where you are logging in.

Commit e54cb695 authored by Joshua Wise's avatar Joshua Wise Committed by Evan Prodromou

Escape query parameters in Profile_tag::getTagged()

This patch escapes query parameters in Profile_tag::getTagged(). This
is an extra security step; since these parameters come out of the
database, it's unlikely that they would have dangerous data in them.
parent 5b118b37
......@@ -310,8 +310,8 @@ class Profile_tag extends Managed_DataObject
$profile->query('SELECT profile.* ' .
'FROM profile JOIN profile_tag ' .
'ON profile.id = profile_tag.tagged ' .
'WHERE profile_tag.tagger = ' . $tagger . ' ' .
'AND profile_tag.tag = "' . $tag . '" ');
'WHERE profile_tag.tagger = ' . $profile->escape($tagger) . ' ' .
'AND profile_tag.tag = "' . $profile->escape($tag) . '" ');
$tagged = array();
while ($profile->fetch()) {
$tagged[] = clone($profile);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment