AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-24 17:30:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
includes/filter_header.php
View File

@@ -47,7 +47,7 @@ if(isset($order) && $order == "ASC") {
// Search
if (isset($_GET['q'])) {
$q = sanitizeInput($_GET['q']);
$q = escapeSql($_GET['q']);
//Phone Numbers
$phone_query = preg_replace("/[^0-9]/", '', $q);
if (empty($phone_query)) {
@@ -60,7 +60,7 @@ if (isset($_GET['q'])) {
// Sortby
if (!empty($_GET['sort'])) {
$sort = sanitizeInput(preg_replace('/[^a-z_]/', '', $_GET['sort'])); // JQ 2023-05-09 - See issue #673 on GitHub to see the reasoning why we used preg_replace technically sanitizeInput() should have been enough to escape SQL Commands
$sort = escapeSql(preg_replace('/[^a-z_]/', '', $_GET['sort'])); // JQ 2023-05-09 - See issue #673 on GitHub to see the reasoning why we used preg_replace technically escapeSql() should have been enough to escape SQL Commands
}
// Date Handling
@@ -72,8 +72,8 @@ if (empty($_GET['canned_date'])) {
// Date Filter
if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) {
$dtf = sanitizeInput($_GET['dtf']);
$dtt = sanitizeInput($_GET['dtt']);
$dtf = escapeSql($_GET['dtf']);
$dtt = escapeSql($_GET['dtt']);
} elseif ($_GET['canned_date'] == "today") {
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');