Congegni/sintonia
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

CC-5121: fix some SQL statements not being escaped/prepared

Browse source
This commit is contained in:
Martin Konecny 2013-05-09 15:08:47 -04:00
parent 21df9013ee
commit 9c05511613
4 changed files with 77 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

9
airtime_mvc/application/models/StreamSetting.php
View file

@ -265,11 +265,12 @@ class Application_Model_StreamSetting
*/
public static function setIndividualStreamSetting($data)
{
$con = Propel::getConnection();
foreach ($data as $keyname => $v) {
$sql = "UPDATE cc_stream_setting SET value='$v' WHERE keyname='$keyname'";
$con->exec($sql);
$sql = "UPDATE cc_stream_setting SET value=:v WHERE keyname=:keyname";
$map = array(":v" => $v, ":keyname"=>$keyname);
$res = Application_Common_Database::prepareAndExecute($sql, $map,
Application_Common_Database::EXECUTE);
}
}