[Noalyss-commit] [noalyss] 02/06: Protect SQL , utilisation de bind variable

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 9d6cb61886b0efa4e0bd195534058093bad9c4c7
Author: sparkyx <danydb@noalyss.eu>
AuthorDate: Thu Feb 11 10:50:34 2021 +0100

    Protect SQL , utilisation de bind variable
---
 include/class/fiche.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/class/fiche.class.php b/include/class/fiche.class.php
index 3405c94..7c12578 100644
--- a/include/class/fiche.class.php
+++ b/include/class/fiche.class.php
@@ -193,10 +193,10 @@ class Fiche
                    fiche
              natural join fiche_detail
             join jnt_fic_attr on (jnt_fic_attr.fd_id=fiche.fd_id and 
fiche_detail.ad_id=jnt_fic_attr.ad_id)
-             join attr_def on (attr_def.ad_id=fiche_detail.ad_id) where 
f_id=".$this->id.
+             join attr_def on (attr_def.ad_id=fiche_detail.ad_id) where 
f_id=$1".
              " order by jnt_order";
 
-        $Ret=$this->cn->exec_sql($sql);
+        $Ret=$this->cn->exec_sql($sql,[$this->id]);
         if ( ($Max=Database::num_row($Ret)) == 0 )
             return ;
         for ($i=0;$i<$Max;$i++)