Web lists-archives.com

Re: [PHP] error Undefined index:





> Date: Wednesday, March 28, 2018 14:13:22 +0000
> From: Alejandro Michelin Salomon <amichelins@xxxxxxxxxxx>
>
> Hi.
> 
> 
> Change FROM
> 
> $empresa = $_POST['empresa'];
> 
> 
> TO
> 
> // To have a default value
> 
> $empresa =  ( isset( $_POST['empresa'] ) ) ? $_POST['empresa'] : '';
> 
>> 
>> if ( $_POST ) {
>> $result=pg_query("SELECT empresa, sum(valor) valor FROM trabajos
>> WHERE empresa='$empresa' and to_char(fecha, 'TMMONTH')::varchar =
>> '$mes' and date_part('year', fecha)= '$anio'
>> group by empresa");
>> $registros= pg_num_rows($result);
>> 


Do not ignore that using a $_POST value, without sanitizing it first
is, as has been pointed out, a very serious sql injection
vulnerability vector. You might have fixed the "Undefined index"
issue, but this code (as previously presented) isn't something that
should be put into use.



-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php