Prevent SQL injection

IMC-GER · IMC-GER · commit eebaa4462fd3 · 2024-06-19T21:06:27.000+02:00
diff --git a/imcger/imgupload/event/main_listener.php b/imcger/imgupload/event/main_listener.php
@@ -120,7 +120,7 @@ public function set_template_vars()
 		while ($group_row = $this->db->sql_fetchrow($result_group))
 		{
 			// Get extension from image groups
-			$sql_ary =  'SELECT extension FROM ' . EXTENSIONS_TABLE	. ' WHERE group_id = ' . $group_row['group_id'];
+			$sql_ary =  'SELECT extension FROM ' . EXTENSIONS_TABLE	. ' WHERE group_id = ' . (int) $group_row['group_id'];
 			$result_ext = $this->db->sql_query($sql_ary);
 
 			while ($row = $this->db->sql_fetchrow($result_ext))

Original file line number	Diff line number	Diff line change
`@@ -120,7 +120,7 @@ public function set_template_vars()`
`120`	`120`	`while ($group_row = $this->db->sql_fetchrow($result_group))`
`121`	`121`	`{`
`122`	`122`	`// Get extension from image groups`
`123`		`- $sql_ary = 'SELECT extension FROM ' . EXTENSIONS_TABLE . ' WHERE group_id = ' . $group_row['group_id'];`
	`123`	`+ $sql_ary = 'SELECT extension FROM ' . EXTENSIONS_TABLE . ' WHERE group_id = ' . (int) $group_row['group_id'];`
`124`	`124`	`$result_ext = $this->db->sql_query($sql_ary);`
`125`	`125`
`126`	`126`	`while ($row = $this->db->sql_fetchrow($result_ext))`