DTux/dtux__serveur-vote-lalis
Archived
1
0
Fork 0
Code

added protection on insert in database

Browse Source
This commit is contained in:
Daniel Tartavel 2022-09-26 11:54:58 +02:00
parent ae357e7e95
commit 943961cca2
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gestion/saisieCandidats.php
View File

@ -12,9 +12,9 @@ $idVote = getpost("idVote");
$candidat = getpost("candidat"); $candidat = getpost("candidat");
$libelle = getpost("libelle"); $libelle = getpost("libelle");
if (!empty($idCandidat)) if (!empty($candidat))
{ {
$query = "INSERT INTO liste_candidats VALUES (0, " . $idVotation . ", " . $idVote . ",'" . $libelle . "', '". $candidat . "')"; $query = "INSERT INTO liste_candidats VALUES (0, " . $db->protect($idVotation) . ", " . $db->protect($idVote) . ",'" . $db->protect($libelle) . "', '". $db->protect($candidat) . "')";
$db->query($query); $db->query($query);
header("Location: " . $$base_url . "/" . $path , TRUE, 301); header("Location: " . $$base_url . "/" . $path , TRUE, 301);
return; return;

2
gestion/saisieVotation.php
View File

@ -24,7 +24,7 @@ $dateFin = getpost("dateFin");
if ($titre !== null and $libelle!== null and $dateDebut!== null and $dateFin !== null) if ($titre !== null and $libelle!== null and $dateDebut!== null and $dateFin !== null)
{ {
$db = new db(); $db = new db();
$query = "INSERT INTO liste_votations VALUES(0, '" . $titre . "', '" . $libelle . "', '0', '" . $dateDebut . "', '" . $dateFin . "')"; // clotûre $query = "INSERT INTO liste_votations VALUES(0, '" . $db->protect($titre) . "', '" . $db->protect($libelle) . "', '0', '" . $db->protect($dateDebut) . "', '" . $db->protect($dateFin) . "')"; // clotûre
$db->query($query); $db->query($query);
$db->close(); $db->close();
// TODO retour à l'index // TODO retour à l'index

2
gestion/saisieVotes.php
View File

@ -16,7 +16,7 @@ if (!empty($idVotation))
{ {
if (!empty($method) and !empty($libelle)) if (!empty($method) and !empty($libelle))
{ {
$query = "INSERT INTO liste_votes VALUES (0, '" . $libelle . "', " . $method . "," . $idVotation . ")"; $query = "INSERT INTO liste_votes VALUES (0, '" . $db->protect($libelle) . "', " . $db->protect($method) . "," . $db->protect($idVotation) . ")";
$db->query($query); $db->query($query);
header("Location: " . $$base_url . "/" . $path , TRUE, 301); header("Location: " . $$base_url . "/" . $path , TRUE, 301);
return; return;