Update product_detail_replace.php
Make the compare case-insensitive to prevent lowercase 'select' from passing-by
This commit is contained in:
1 parent
ab743acf98
commit
38e0c9fb53
1 file changed
+2
-2
@@ -62,8 +62,8 @@ $connection = new mysqli('localhost', 'webshop', 'pass', 'webshop')
|
||||
$id = $_GET['id'];
|
||||
|
||||
// Damn hackers, let's filter out all SELECT and UNION to be extra safe!
|
||||
$id = str_replace('SELECT', '', $id);
|
||||
$id = str_replace('UNION', '', $id);
|
||||
$id = str_ireplace('SELECT', '', $id);
|
||||
$id = str_ireplace('UNION', '', $id);
|
||||
|
||||
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . $connection->real_escape_string($id);
|
||||
|
||||
|
||||
Reference in new issue
Block a user