jody/alertmon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove SQL injection on GET /core/:id endpoint with parameterized statement.

Browse Source
This commit is contained in:
jkaplon 2015-07-16 14:15:06 -04:00
parent f919c51f33
commit 5f07c25ade
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
server.js
View File

@ -86,7 +86,7 @@ app.get('/core/:id', function(req, res){
var d = new Date(); var d = new Date();
var coreId = req.params.id; var coreId = req.params.id;
console.log("GET /core/" + coreId + ", " + JSON.stringify(d, 4)); console.log("GET /core/" + coreId + ", " + JSON.stringify(d, 4));
db.all("SELECT coreId, published_at, status, coreName FROM Alerts WHERE coreId = '" + coreId + "' ORDER BY published_at DESC LIMIT 30;", function(err, rows){ db.all("SELECT coreId, published_at, status, coreName FROM Alerts WHERE coreId = ? ORDER BY published_at DESC LIMIT 30;", coreId, function(err, rows){
if(err !== null) { if(err !== null) {
console.log(err); console.log(err);
} else { } else {