From bfa4483722b510f028e60492783b9e90e128374e Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 21 May 2019 17:41:41 +0200 Subject: [PATCH] More robust test against sql injections --- htdocs/main.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index a7d0669db22..b0d34db43eb 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -91,7 +91,7 @@ function testSqlAndScriptInject($val, $type) } if ($type == 3) { - $inj += preg_match('/select|update|delete|replace|group\s+by|concat|count|from/i', $val); + $inj += preg_match('/select|update|delete|truncate|replace|group\s+by|concat|count|from|union/i', $val); } if ($type != 2) // Not common key strings, so we can check them both on GET and POST {