joelwan / php-object-generator

ORM class generator for PHP
http://www.phpobjectgenerator.com
29 stars 30 forks source link

Missing intval in Delete Function #16

Closed Loksly closed 2 weeks ago

Loksly commented 10 years ago

I'm not right now using my own computer, so I prefer not to change this line of code using github file editor. I can't test the code further than using php -l command. Anyway I've realized right now that this line:

https://github.com/joelwan/php-object-generator/blob/master/object_factory/class.objectphp5pogmysql.php#L500

should use intval to prevent sql code injection. Then it will be like this one:

$this->string .= "\n\t\t\$this->pog_query = \"delete from `".strtolower($this->objectName)."` where `".strtolower($this->objectName)."id`='\".\intval($this->".strtolower($this->objectName)."Id).\"'\";";

I'll update this asap.