aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--include/functions.inc.php4
-rw-r--r--search.php4
2 files changed, 5 insertions, 3 deletions
diff --git a/include/functions.inc.php b/include/functions.inc.php
index a08bd94b4..a3feb477b 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -1887,9 +1887,9 @@ function check_input_parameter($param_name, $param_array, $is_array, $pattern, $
fatal_error('[Hacking attempt] the input parameter "'.$param_name.'" should be an array');
}
- foreach ($param_value as $item_to_check)
+ foreach ($param_value as $key => $item_to_check)
{
- if (!preg_match($pattern, $item_to_check))
+ if (!preg_match(PATTERN_ID, $key) or !preg_match($pattern, $item_to_check))
{
fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"');
}
diff --git a/search.php b/search.php
index 6feee2780..fed2e4c5f 100644
--- a/search.php
+++ b/search.php
@@ -105,6 +105,8 @@ if (isset($_POST['submit']))
}
// dates
+ check_input_parameter('date_type', $_POST, false, '/^date_(creation|available)$/');
+
$type_date = $_POST['date_type'];
if (!empty($_POST['start_year']))
@@ -144,7 +146,7 @@ if (isset($_POST['submit']))
INSERT INTO '.SEARCH_TABLE.'
(rules, last_seen)
VALUES
- (\''.serialize($search).'\', NOW())
+ (\''.pwg_db_real_escape_string(serialize($search)).'\', NOW())
;';
pwg_query($query);