Skip to content

Use prepared statements to replace sql#3037

Merged
killing merged 2 commits into
masterfrom
fix_sql_inj
Jun 11, 2026
Merged

Use prepared statements to replace sql#3037
killing merged 2 commits into
masterfrom
fix_sql_inj

Conversation

@feiniks

@feiniks feiniks commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

No description provided.

Comment thread daemon/seafile-config.c Outdated
if (sqlite_query_exec (session->config_db, sql) < 0)
if (sqlite_query_exec (session->config_db,
"REPLACE INTO Config VALUES (?, ?)",
2, "string", key, "int", value) < 0)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

value 的类型应该是 text。这里的代码应该本来就不是很对,直接传入了一个 int,只是 SQLite 应该自动做了类型转换。

@killing killing merged commit badb8a5 into master Jun 11, 2026
@killing killing deleted the fix_sql_inj branch June 11, 2026 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants