2
Hi culex, thanks for this module.
I downloaded it, I did not installed it but I took a quick look at the code and I noticed some things:
- functions are not prefixed, you should prefix functions with he module name to avoid namespace collisions and consecutive blank pages. Example: function showextinfo($oa_id) should be function onair_showextinfo($oa_id) or even function onair_showExtInfo($oa_id)
- you are using input from users directly into sql statements. This will get any site using this module vulnerable to exploitation with SQL injection.
this is a bad pratice:
$oa_id = $_GET['oa_id'];
$query = 'SELECT * FROM '.$xoopsDB->prefix('oa_program').' WHERE oa_id='.$oa_id.'';
Use $xoopsDB->quoteString(), intval() or $myts->addSlashes() to clean/addslashes/quote values used is sql queries
$oa_id = $_GET['oa_id'];
$query = 'SELECT * FROM '.$xoopsDB->prefix('oa_program').' WHERE oa_id='.intval($oa_id).'';
$myts =& MyTextSanitizer::getInstance();
$query = 'SELECT * FROM '.$xoopsDB->prefix('oa_program').' WHERE oa_name LIKE '.$myts->addSlashes("%{$oa_name}%").'' ORDER BY oa_day,oa_start ASC';
Note: this code boxes above are not displaying correctly \' :(
