mirror of
https://github.com/magicbug/Cloudlog
synced 2026-08-13 17:49:35 -04:00
Normalize incoming ID parameters to integers and replace concatenated/raw SQL with CodeIgniter query builder. Controllers (Contesting.php, Themes.php) now cast $id to (int) instead of using xss_clean; models (Contesting_model.php, Themes_model.php) cast $id and use $this->db->where()/get()/select() to build queries. This improves type safety and reduces risk of injection while using more idiomatic CI DB APIs.
48 lines
1,007 B
PHP
48 lines
1,007 B
PHP
<?php
|
|
class Themes_model extends CI_Model {
|
|
|
|
// FUNCTION: array getThemes()
|
|
// Returns a list of themes
|
|
function getThemes() {
|
|
$result = $this->db->query('SELECT * FROM themes order by name');
|
|
|
|
return $result->result();
|
|
}
|
|
|
|
function delete($id) {
|
|
// Clean ID
|
|
$clean_id = $this->security->xss_clean($id);
|
|
|
|
// Delete Theme
|
|
$this->db->delete('themes', array('id' => $clean_id));
|
|
}
|
|
|
|
function add() {
|
|
$data = array(
|
|
'name' => xss_clean($this->input->post('name', true)),
|
|
'foldername' => xss_clean($this->input->post('foldername', true)),
|
|
);
|
|
|
|
$this->db->insert('themes', $data);
|
|
}
|
|
|
|
|
|
function theme($id) {
|
|
$clean_id = (int) $id;
|
|
|
|
$this->db->where('id', $clean_id);
|
|
$data = $this->db->get('themes');
|
|
|
|
return ($data->row());
|
|
}
|
|
|
|
function edit($id) {
|
|
$data = array(
|
|
'name' => xss_clean($this->input->post('name', true)),
|
|
'foldername' => xss_clean($this->input->post('foldername', true)),
|
|
);
|
|
|
|
$this->db->where('id', $id);
|
|
$this->db->update('themes', $data);
|
|
}
|
|
}
|