cloudlog/application/models/Themes_model.php
Peter Goodhall f5e3aac0d0 Cast IDs to int; use query builder
Normalize incoming ID parameters to integers and replace concatenated/raw SQL with CodeIgniter query builder. Controllers (Contesting.php, Themes.php) now cast $id to (int) instead of using xss_clean; models (Contesting_model.php, Themes_model.php) cast $id and use $this->db->where()/get()/select() to build queries. This improves type safety and reduces risk of injection while using more idiomatic CI DB APIs.
2026-06-24 22:08:30 +01:00

48 lines
1,007 B
PHP

<?php
class Themes_model extends CI_Model {
// FUNCTION: array getThemes()
// Returns a list of themes
function getThemes() {
$result = $this->db->query('SELECT * FROM themes order by name');
return $result->result();
}
function delete($id) {
// Clean ID
$clean_id = $this->security->xss_clean($id);
// Delete Theme
$this->db->delete('themes', array('id' => $clean_id));
}
function add() {
$data = array(
'name' => xss_clean($this->input->post('name', true)),
'foldername' => xss_clean($this->input->post('foldername', true)),
);
$this->db->insert('themes', $data);
}
function theme($id) {
$clean_id = (int) $id;
$this->db->where('id', $clean_id);
$data = $this->db->get('themes');
return ($data->row());
}
function edit($id) {
$data = array(
'name' => xss_clean($this->input->post('name', true)),
'foldername' => xss_clean($this->input->post('foldername', true)),
);
$this->db->where('id', $id);
$this->db->update('themes', $data);
}
}