AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-24 01:10:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
includes/filter_header.php
View File

@@ -47,7 +47,7 @@ if(isset($order) && $order == "ASC") {
// Search
if (isset($_GET['q'])) {
$q = sanitizeInput($_GET['q']);
$q = escapeSql($_GET['q']);
//Phone Numbers
$phone_query = preg_replace("/[^0-9]/", '', $q);
if (empty($phone_query)) {
@@ -60,7 +60,7 @@ if (isset($_GET['q'])) {
// Sortby
if (!empty($_GET['sort'])) {
$sort = sanitizeInput(preg_replace('/[^a-z_]/', '', $_GET['sort'])); // JQ 2023-05-09 - See issue #673 on GitHub to see the reasoning why we used preg_replace technically sanitizeInput() should have been enough to escape SQL Commands
$sort = escapeSql(preg_replace('/[^a-z_]/', '', $_GET['sort'])); // JQ 2023-05-09 - See issue #673 on GitHub to see the reasoning why we used preg_replace technically escapeSql() should have been enough to escape SQL Commands
}
// Date Handling
@@ -72,8 +72,8 @@ if (empty($_GET['canned_date'])) {
// Date Filter
if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) {
$dtf = sanitizeInput($_GET['dtf']);
$dtt = sanitizeInput($_GET['dtt']);
$dtf = escapeSql($_GET['dtf']);
$dtt = escapeSql($_GET['dtt']);
} elseif ($_GET['canned_date'] == "today") {
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');

8
includes/load_user_session.php
View File

@@ -1,7 +1,7 @@
<?php
$session_ip = sanitizeInput(getIP());
$session_user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']);
$session_ip = escapeSql(getIP());
$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']);
$session_user_id = intval($_SESSION['user_id']);
$sql = mysqli_query(
@@ -14,7 +14,7 @@ $sql = mysqli_query(
$row = mysqli_fetch_assoc($sql);
$session_name = sanitizeInput($row['user_name']);
$session_name = escapeSql($row['user_name']);
$session_email = $row['user_email'];
$session_avatar = $row['user_avatar'];
$session_token = $row['user_token'];
@@ -22,7 +22,7 @@ $session_user_type = intval($row['user_type']);
$session_user_archived_at = $row['user_archived_at'];
$session_user_status = intval($row['user_status']);
$session_user_role = intval($row['user_role_id']);
$session_user_role_display = sanitizeInput($row['role_name']);
$session_user_role_display = escapeSql($row['role_name']);
$session_is_admin = isset($row['role_is_admin']) && $row['role_is_admin'] == 1;
$session_user_config_force_mfa = intval($row['user_config_force_mfa']);
$user_config_records_per_page = intval($row['user_config_records_per_page']);

2
includes/page_title.php
View File

@@ -13,7 +13,7 @@ $page_title = str_replace('_', ' ', $page_title);
$page_title = ucwords($page_title);
// Sanitize title for SQL input such as logging
$page_title_sanitized = sanitizeInput($page_title);
$page_title_sanitized = escapeSql($page_title);
// Sanitize the page title to prevent XSS for output
$page_title = escapeHtml($page_title);