Mailing List Archive

commit 9246736ea974230526225e1bbd244a4f7dcff91a
Author: Peter Ajamian <peter@pajamian.dhs.org>
Date: Fri Mar 3 10:03:25 2017 +0100

Use proper quoting of query parameters in get_cart_by_name method.

lib/WellWell/DatabaseCart.pm | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/lib/WellWell/DatabaseCart.pm b/lib/WellWell/DatabaseCart.pm
index 2f10f3c..1e5aca3 100644
--- a/lib/WellWell/DatabaseCart.pm
+++ b/lib/WellWell/DatabaseCart.pm
@@ -135,8 +135,8 @@ sub get_cart_by_name {

$db_carts = database_exists_ref('carts');

- $set = $db_carts->query(q{select carts_id from carts where name = '%s' and username = '%s'},
- $name, $uid);
+ $set = $db_carts->query(q{select carts_id from carts where name = %s and username = %s},
+ $db_carts->quote($name), $db_carts->quote($uid));

if (@$set) {
$code = $set->[0]->[0];

_______________________________________________
interchange-cvs mailing list
interchange-cvs@icdevgroup.org
http://www.icdevgroup.org/mailman/listinfo/interchange-cvs