From e54cb6958a90934ecfffcfd0074e7dc09d96c13b Mon Sep 17 00:00:00 2001 From: Joshua Wise Date: Tue, 16 Jul 2013 10:35:44 -0700 Subject: [PATCH] Escape query parameters in Profile_tag::getTagged() This patch escapes query parameters in Profile_tag::getTagged(). This is an extra security step; since these parameters come out of the database, it's unlikely that they would have dangerous data in them. --- classes/Profile_tag.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/classes/Profile_tag.php b/classes/Profile_tag.php index fdac14cd71..75cca8c22c 100644 --- a/classes/Profile_tag.php +++ b/classes/Profile_tag.php @@ -310,8 +310,8 @@ class Profile_tag extends Managed_DataObject $profile->query('SELECT profile.* ' . 'FROM profile JOIN profile_tag ' . 'ON profile.id = profile_tag.tagged ' . - 'WHERE profile_tag.tagger = ' . $tagger . ' ' . - 'AND profile_tag.tag = "' . $tag . '" '); + 'WHERE profile_tag.tagger = ' . $profile->escape($tagger) . ' ' . + 'AND profile_tag.tag = "' . $profile->escape($tag) . '" '); $tagged = array(); while ($profile->fetch()) { $tagged[] = clone($profile);