makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/10714] Cast values to integer before using them in the query

Browse source 
PHPBB3-10714
This commit is contained in:
Joas Schilling 2013-01-22 15:46:48 +01:00
parent c0ab3f3ddd
commit ffde887aad
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
phpBB/includes/log/log.php
View file

@ -408,10 +408,10 @@ class phpbb_log implements phpbb_log_interface
if ($count_logs) if ($count_logs)
{ {
$sql = 'SELECT COUNT(l.log_id) AS total_entries $sql = 'SELECT COUNT(l.log_id) AS total_entries
FROM ' . LOG_TABLE . ' l, ' . USERS_TABLE . " u FROM ' . LOG_TABLE . ' l, ' . USERS_TABLE . ' u
WHERE l.log_type = $log_type WHERE l.log_type = ' . (int) $log_type . '
AND l.user_id = u.user_id AND l.user_id = u.user_id
AND l.log_time >= $log_time AND l.log_time >= ' . (int) $log_time . "
$sql_keywords $sql_keywords
$sql_additional"; $sql_additional";
$result = $this->db->sql_query($sql); $result = $this->db->sql_query($sql);
@ -433,10 +433,10 @@ class phpbb_log implements phpbb_log_interface
} }
$sql = 'SELECT l.*, u.username, u.username_clean, u.user_colour $sql = 'SELECT l.*, u.username, u.username_clean, u.user_colour
FROM ' . LOG_TABLE . ' l, ' . USERS_TABLE . " u FROM ' . LOG_TABLE . ' l, ' . USERS_TABLE . ' u
WHERE l.log_type = $log_type WHERE l.log_type = ' . (int) $log_type . '
AND u.user_id = l.user_id AND u.user_id = l.user_id
" . (($log_time) ? "AND l.log_time >= $log_time" : '') . " ' . (($log_time) ? 'AND l.log_time >= ' . (int) $log_time : '') . "
$sql_keywords $sql_keywords
$sql_additional $sql_additional
ORDER BY $sort_by"; ORDER BY $sort_by";