Some important fixes

2026-08-10 05:11:00 +00:00 · 2026-08-05 10:21:53 +03:00
parent b2dec1d942
commit b21f60c2b1
6 changed files with 190 additions and 45 deletions
@@ -207,6 +207,12 @@ trait DatabaseMarketQueries {
 	***************************/

 	function getMarketField($vref, $id, $field, $use_cache = true) {
+		// Identificatorii intra in SQL fara ghilimele, iar
+		// mysqli_real_escape_string nu protejeaza contextul numeric:
+		// "5 OR 1=1" ar trece neschimbat. Conversia la intreg il opreste.
+		$vref = (int) $vref;
+		$id = (int) $id;
+
 	    list($vref, $id, $field) = $this->escape_input($vref, $id, $field);

        // first of all, check if we should be using cache and whether the field