Projekt

Allgemein

Profil

« Zurück | Weiter » 

Revision 44e8084a

Von Moritz Bunkus vor etwa 11 Jahren hinzugefügt

  • ID 44e8084a0fc69c9e9afea5531186eb28a1b2473a
  • Vorgänger 9d17c830
  • Nachfolger 66f7ff40

steuerfilterung.pl: SQL injection verhindern

Unterschiede anzeigen:

sql/Pg-upgrade2/steuerfilterung.pl
19 19 
  $self->db_query($query);
20 20 

  		




  21
  21
  
    
  if ( $::form->{continued_tax} ) {


  		




  22
  
  
    
    my $update_query;


  		




  23
  22
  
    
    foreach my $i (1 .. $::form->{rowcount}) {


  		




  24
  23
  
    
      $tax_id = $::form->{"tax_id_$i"};


  		




  25
  24
  
    
      $categories = '';


  		




  ......




  29
  28
  
    
      $categories .= 'C' if $::form->{"costs_$i"};


  		




  30
  29
  
    
      $categories .= 'I' if $::form->{"revenue_$i"};


  		




  31
  30
  
    
      $categories .= 'E' if $::form->{"expense_$i"};


  		




  32
  
  
    
      $update_query = qq|UPDATE tax SET chart_categories = '$categories' WHERE id=$tax_id;|;


  		




  33
  
  
    
      $self->db_query($update_query);


  		




  
  31
  
    
      $self->db_query(qq|UPDATE tax SET chart_categories = ? WHERE id = ?|, bind => [ $categories, $tax_id ]);


  		




  34
  32
  
    
    }


  		




  35
  
  
    
    $update_query = qq|ALTER TABLE tax ALTER COLUMN chart_categories SET NOT NULL|;


  		




  36
  
  
    
    $self->db_query($update_query);


  		




  
  33
  
    
    $self->db_query(qq|ALTER TABLE tax ALTER COLUMN chart_categories SET NOT NULL|);


  		




  37
  34
  
    
    return 1;


  		




  38
  35
  
    
  }


  		




  39
  36
  
    

  		




  ......




  75
  72
  
    
      && ($ref->{taxdescription} =~ $_->{taxdescription})


  		




  76
  73
  
    
    } @well_known_taxes;


  		




  77
  74
  
    
    if ($well_known_tax) {


  		




  78
  
  
    
      $categories = $well_known_tax->{categories};


  		




  79
  
  
    
      $tax_id = $ref->{tax_id};


  		




  80
  
  
    
      $query = qq|UPDATE tax SET chart_categories = '$categories' WHERE id=$tax_id;|;


  		




  81
  
  
    
      $self->db_query($query);


  		




  
  75
  
    
      $self->db_query(qq|UPDATE tax SET chart_categories = ? WHERE id = ?|, bind => [ $well_known_tax->{categories}, $ref->{tax_id} ]);


  		




  82
  76
  
    
    } else {


  		




  83
  77
  
    
      $ref->{rate} = $::form->format_amount(\%::myconfig, $ref->{rate} * 100);


  		




  84
  78
  
    
      push @{ $::form->{PARTS} }, $ref;


  		












Auch abrufbar als:  Unified diff