Paul/Security-VM
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update product_detail_replace.php

Browse Source 
Make the compare case-insensitive to prevent lowercase 'select' from passing-by
This commit is contained in:
Paul committed 2014-02-28 14:29:01 +01:00
1 parent ab743acf98
commit 38e0c9fb53
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
webshop/product_detail_replace.php
+2 -2
View File
@@ -62,8 +62,8 @@ $connection = new mysqli('localhost', 'webshop', 'pass', 'webshop')
$id = $_GET['id']; $id = $_GET['id'];
// Damn hackers, let's filter out all SELECT and UNION to be extra safe! // Damn hackers, let's filter out all SELECT and UNION to be extra safe!
$id = str_replace('SELECT', '', $id); $id = str_ireplace('SELECT', '', $id);
$id = str_replace('UNION', '', $id); $id = str_ireplace('UNION', '', $id);
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . $connection->real_escape_string($id); $query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . $connection->real_escape_string($id);