moodleou / moodle-mod_oublog

Alternative blog module for Moodle 2 (including course blogs)
31 stars 27 forks source link

Change SQL string concatenation into SQL parameter #108

Open tmuras opened 3 years ago

tmuras commented 3 years ago

I don't think this could be exploited in any way for SQL injection with the current code - but it's a good idea to change $oublogid: https://github.com/moodleou/moodle-mod_oublog/blob/master/locallib.php#L2336

into SQL parameter.