Update product_detail_replace.php

Make the compare case-insensitive to prevent lowercase 'select' from passing-by
This commit is contained in:
Paul committed 2014-02-28 14:29:01 +01:00
1 parent ab743acf98
commit 38e0c9fb53
1 file changed
+2 -2
+2 -2
View File
@@ -62,8 +62,8 @@ $connection = new mysqli('localhost', 'webshop', 'pass', 'webshop')
$id = $_GET['id'];
// Damn hackers, let's filter out all SELECT and UNION to be extra safe!
$id = str_replace('SELECT', '', $id);
$id = str_replace('UNION', '', $id);
$id = str_ireplace('SELECT', '', $id);
$id = str_ireplace('UNION', '', $id);
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . $connection->real_escape_string($id);