external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

SQL: treat all UID/ID values as numbers, not strings

Browse source 
Ensure we are not quoting these values in any of our SQL queries.

Thanks-to: elij <elij.mx@gmail.com>
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
Dan McGee 2011-04-25 23:23:01 -05:00 • committed by Lukas Fleischer
parent fcda6671f3
commit 3609cf140e
4 changed files with 15 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
web/lib/aur.inc
View file

@ -478,7 +478,7 @@ function mkurl($append) {
function get_salt($user_id)
{
$dbh = db_connect();
$salt_q = "SELECT Salt FROM Users WHERE ID = '$user_id'";
$salt_q = "SELECT Salt FROM Users WHERE ID = " . $user_id;
$salt_result = mysql_fetch_row(db_query($salt_q, $dbh));
return $salt_result[0];
}
@ -488,8 +488,8 @@ function save_salt($user_id, $passwd)
$dbh = db_connect();
$salt = generate_salt();
$hash = salted_hash($passwd, $salt);
$salting_q = "UPDATE Users SET Salt = '$salt'" .
", Passwd = '$hash' WHERE ID = '$user_id'";
$salting_q = "UPDATE Users SET Salt = '" . $salt . "', " .
"Passwd = '" . $hash . "' WHERE ID = " . $user_id;
return db_query($salting_q, $dbh);
}