- improved input validation

Marius Cramer · Marius Cramer · commit 65ad3435addc · 2014-08-13T12:52:18.000+02:00
diff --git a/interface/lib/classes/functions.inc.php b/interface/lib/classes/functions.inc.php
@@ -248,7 +248,7 @@ public function suggest_ips($type = 'IPv4'){
 		}
 
 		$ips = array();
-		$results = $app->db->queryAllRecords("SELECT ip_address AS ip, server_id FROM server_ip WHERE ip_type = '".$type."'");
+		$results = $app->db->queryAllRecords("SELECT ip_address AS ip, server_id FROM server_ip WHERE ip_type = '".$app->db->quote($type)."'");
 		if(!empty($results) && is_array($results)){
 			foreach($results as $result){
 				if(preg_match($regex, $result['ip'])){

Original file line number	Diff line number	Diff line change
`@@ -248,7 +248,7 @@ public function suggest_ips($type = 'IPv4'){`
`248`	`248`	`}`
`249`	`249`
`250`	`250`	`$ips = array();`
`251`		`- $results = $app->db->queryAllRecords("SELECT ip_address AS ip, server_id FROM server_ip WHERE ip_type = '".$type."'");`
	`251`	`+ $results = $app->db->queryAllRecords("SELECT ip_address AS ip, server_id FROM server_ip WHERE ip_type = '".$app->db->quote($type)."'");`
`252`	`252`	`if(!empty($results) && is_array($results)){`
`253`	`253`	`foreach($results as $result){`
`254`	`254`	`if(preg_match($regex, $result['ip'])){`