From 3609cf140eaca30878d0a69fba0d837b4fec41a0 Mon Sep 17 00:00:00 2001 From: Dan McGee Date: Mon, 25 Apr 2011 23:23:01 -0500 Subject: SQL: treat all UID/ID values as numbers, not strings Ensure we are not quoting these values in any of our SQL queries. Thanks-to: elij Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer --- web/lib/aur.inc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'web/lib/aur.inc') diff --git a/web/lib/aur.inc b/web/lib/aur.inc index 744b31e..66ae1c2 100644 --- a/web/lib/aur.inc +++ b/web/lib/aur.inc @@ -478,7 +478,7 @@ function mkurl($append) { function get_salt($user_id) { $dbh = db_connect(); - $salt_q = "SELECT Salt FROM Users WHERE ID = '$user_id'"; + $salt_q = "SELECT Salt FROM Users WHERE ID = " . $user_id; $salt_result = mysql_fetch_row(db_query($salt_q, $dbh)); return $salt_result[0]; } @@ -488,8 +488,8 @@ function save_salt($user_id, $passwd) $dbh = db_connect(); $salt = generate_salt(); $hash = salted_hash($passwd, $salt); - $salting_q = "UPDATE Users SET Salt = '$salt'" . - ", Passwd = '$hash' WHERE ID = '$user_id'"; + $salting_q = "UPDATE Users SET Salt = '" . $salt . "', " . + "Passwd = '" . $hash . "' WHERE ID = " . $user_id; return db_query($salting_q, $dbh); } -- cgit v1.2.3-54-g00ecf