From: Joshua Wise <jwise@nvidia.com>
Date: Tue, 16 Jul 2013 17:35:44 +0000 (-0700)
Subject: Escape query parameters in Profile_tag::getTagged()
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=e54cb6958a90934ecfffcfd0074e7dc09d96c13b;p=quix0rs-gnu-social.git

Escape query parameters in Profile_tag::getTagged()

This patch escapes query parameters in Profile_tag::getTagged(). This
is an extra security step; since these parameters come out of the
database, it's unlikely that they would have dangerous data in them.
---

diff --git a/classes/Profile_tag.php b/classes/Profile_tag.php
index fdac14cd71..75cca8c22c 100644
--- a/classes/Profile_tag.php
+++ b/classes/Profile_tag.php
@@ -310,8 +310,8 @@ class Profile_tag extends Managed_DataObject
         $profile->query('SELECT profile.* ' .
                         'FROM profile JOIN profile_tag ' .
                         'ON profile.id = profile_tag.tagged ' .
-                        'WHERE profile_tag.tagger = ' . $tagger . ' ' .
-                        'AND profile_tag.tag = "' . $tag . '" ');
+                        'WHERE profile_tag.tagger = ' . $profile->escape($tagger) . ' ' .
+                        'AND profile_tag.tag = "' . $profile->escape($tag) . '" ');
         $tagged = array();
         while ($profile->fetch()) {
             $tagged[] = clone($profile);