summaryrefslogtreecommitdiff
path: root/web/lib/aur.inc
diff options
context:
space:
mode:
authorDan McGee <dan@archlinux.org>2011-04-25 23:23:01 -0500
committerLukas Fleischer <archlinux@cryptocrack.de>2011-04-27 14:50:27 +0200
commit3609cf140eaca30878d0a69fba0d837b4fec41a0 (patch)
tree5132be13c5b5afb70c7d281c6220f9fb5cbbcf2a /web/lib/aur.inc
parentfcda6671f3021273844f7898c7cfec1e99df8ec2 (diff)
SQL: treat all UID/ID values as numbers, not strings
Ensure we are not quoting these values in any of our SQL queries. Thanks-to: elij <elij.mx@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/lib/aur.inc')
-rw-r--r--web/lib/aur.inc6
1 files changed, 3 insertions, 3 deletions
diff --git a/web/lib/aur.inc b/web/lib/aur.inc
index 744b31e..66ae1c2 100644
--- a/web/lib/aur.inc
+++ b/web/lib/aur.inc
@@ -478,7 +478,7 @@ function mkurl($append) {
function get_salt($user_id)
{
$dbh = db_connect();
- $salt_q = "SELECT Salt FROM Users WHERE ID = '$user_id'";
+ $salt_q = "SELECT Salt FROM Users WHERE ID = " . $user_id;
$salt_result = mysql_fetch_row(db_query($salt_q, $dbh));
return $salt_result[0];
}
@@ -488,8 +488,8 @@ function save_salt($user_id, $passwd)
$dbh = db_connect();
$salt = generate_salt();
$hash = salted_hash($passwd, $salt);
- $salting_q = "UPDATE Users SET Salt = '$salt'" .
- ", Passwd = '$hash' WHERE ID = '$user_id'";
+ $salting_q = "UPDATE Users SET Salt = '" . $salt . "', " .
+ "Passwd = '" . $hash . "' WHERE ID = " . $user_id;
return db_query($salting_q, $dbh);
}