From 4a30da924a52b16fb863649e5f5da14b26ab70c4 Mon Sep 17 00:00:00 2001 From: Joshua Wise Date: Tue, 16 Jul 2013 10:43:56 -0700 Subject: [PATCH] Escape argument to User::getTaggedSubscribers() to preven SQL injection This change escapes the argument to User::getTaggedSubscribers() to prevent SQL injection attacks. Both code paths up the stack fail to escape this parameter, so this is a potential SQL injection attack. --- classes/User.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/classes/User.php b/classes/User.php index 8d21d2bc19..cd99a3dd4f 100644 --- a/classes/User.php +++ b/classes/User.php @@ -736,7 +736,7 @@ class User extends Managed_DataObject $profile = new Profile(); - $cnt = $profile->query(sprintf($qry, $this->id, $tag)); + $cnt = $profile->query(sprintf($qry, $this->id, $profile->escape($tag))); return $profile; } -- 2.39.5