copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #213 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-lookup

Browse Source 
Fix SQL injection in vehicle plate order history lookup
This commit is contained in:
Jeppe B
2026-06-01 23:08:35 +02:00
committed by GitHub
parent 1d05550cd3 1065973b33
commit 7bb67b0470
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/objects/orders_o.php
+8 -2
View File
@@ -593,8 +593,14 @@ class orders_o extends db
public function get_vehicle_order_history(string $plate): array
{
global $db;
$sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' AND deleted_at IS NULL ORDER BY id DESC LIMIT 5";
$result = $db->query($sql);
$stmt = $db->prepare("SELECT * FROM $this->table WHERE (reg_1 = ? OR reg_2 = ? OR reg_3 = ?) AND deleted_at IS NULL ORDER BY id DESC LIMIT 5");
if (!$stmt) {
return [];
}
$stmt->bind_param('sss', $plate, $plate, $plate);
$stmt->execute();
$result = $stmt->get_result();
$stmt->close();
return $db->fetch_all($result);
}