ThaMunsta/itflow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sanitize each Status in Array

Browse Source
This commit is contained in:
johnnyq
2023-11-21 15:41:03 -05:00
parent 3749cbfca1
commit 1f9c6578d5
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
tickets.php
View File

@@ -9,9 +9,16 @@ require_once "inc_all.php";
// Ticket status from GET // Ticket status from GET
if (isset($_GET['status']) && is_array($_GET['status']) && !empty($_GET['status'])) { if (isset($_GET['status']) && is_array($_GET['status']) && !empty($_GET['status'])) {
// Convert the selected statuses into a comma-separated string // Sanitize each element of the status array
$selectedStatuses = implode("','", $_GET['status']); $sanitizedStatuses = array();
$ticket_status_snippet = "ticket_status IN ('$selectedStatuses')"; foreach ($_GET['status'] as $status) {
// Escape each status to prevent SQL injection
$sanitizedStatuses[] = "'" . sanitizeInput($status) . "'";
}
// Convert the sanitized statuses into a comma-separated string
$sanitizedStatusesString = implode(",", $sanitizedStatuses);
$ticket_status_snippet = "ticket_status IN ($sanitizedStatusesString)";
} else { } else {
if (isset($_GET['status']) && ($_GET['status']) == 'Open') { if (isset($_GET['status']) && ($_GET['status']) == 'Open') {