joshuacoles/wallos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adding input validation before saving to the db (#105)

Browse Source
This commit is contained in:
lslschr
2024-02-10 13:58:31 +01:00
committed by GitHub
parent 05f9332fb8
commit 048bf2d0aa
6 changed files with 60 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
endpoints/categories/category.php
+9 -2
View File
@@ -1,6 +1,13 @@
<?php
require_once '../../includes/connect_endpoint.php';
session_start();
function validate($value) {
$value = trim($value);
$value = stripslashes($value);
$value = htmlspecialchars($value);
$value = htmlentities($value);
return $value;
}
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {
if (isset($_GET['action']) && $_GET['action'] == "add") {
$categoryName = "Category";
@@ -26,7 +33,7 @@ if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {
} else if (isset($_GET['action']) && $_GET['action'] == "edit") {
if (isset($_GET['categoryId']) && $_GET['categoryId'] != "" && isset($_GET['name']) && $_GET['name'] != "") {
$categoryId = $_GET['categoryId'];
$name = $_GET['name'];
$name = validate($_GET['name']);
$sql = "UPDATE categories SET name = :name WHERE id = :categoryId";
$stmt = $db->prepare($sql);
$stmt->bindParam(':name', $name, SQLITE3_TEXT);
@@ -102,4 +109,4 @@ if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {
echo translate('error', $i18n);
}
?>
?>