From 3609cf140eaca30878d0a69fba0d837b4fec41a0 Mon Sep 17 00:00:00 2001 From: Dan McGee Date: Mon, 25 Apr 2011 23:23:01 -0500 Subject: SQL: treat all UID/ID values as numbers, not strings Ensure we are not quoting these values in any of our SQL queries. Thanks-to: elij Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer --- web/html/passreset.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'web/html/passreset.php') diff --git a/web/html/passreset.php b/web/html/passreset.php index 2c7801d7..0ce6f7da 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -58,8 +58,8 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir $resetkey = new_sid(); $dbh = db_connect(); $q = "UPDATE Users - SET ResetKey = '$resetkey' - WHERE ID = '$uid'"; + SET ResetKey = '" . $resetkey . "' + WHERE ID = " . $uid; db_query($q, $dbh); # Send email with confirmation link $body = __('A password reset request was submitted for the account '. -- cgit v1.2.3-24-g4f1b