SF.net SVN: jgbbs: [89] jgbbs3/trunk/search.asp

[<ha...@us...>]

Revision: 89
          http://jgbbs.svn.sourceforge.net/jgbbs/?rev=89&view=rev
Author:   hanru
Date:     2007-04-27 05:20:03 -0700 (Fri, 27 Apr 2007)

Log Message:
-----------
Sanitize the "author" querying string, hopefully fix a SQL injection exploit.

Modified Paths:
--------------
    jgbbs3/trunk/search.asp

Modified: jgbbs3/trunk/search.asp
===================================================================
--- jgbbs3/trunk/search.asp	2007-02-10 12:13:04 UTC (rev 88)
+++ jgbbs3/trunk/search.asp	2007-04-27 12:20:03 UTC (rev 89)
@@ -160,6 +160,9 @@
     author = Request.QueryString("author")
     bid = Request.QueryString("bid")
     
+    ' Sanitize this string, hopefully fix a SQL injection exploit
+    author = StripQuotes(author)
+    
     ' Check parameters
     If Not IsNumeric(bid) Then
         bid = 0


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.