View Single Post
  #1  
Old 10th November 2019, 08:00
BamBam0077 BamBam0077 is offline
Banned
 
Join Date: Jul 2013
P2P
Posts: 410
Default MailBox SQL injection updates
PHP Code:
if (isset($_GET['inbox']))
{
$pagename T_("INBOX");
$tablefmt " ,Sender,Subject,Date";
$where "`receiver` = $CURUSER[id] AND `location` IN ('in','both')";
$type "Mail";
}
elseif (isset(
$_GET['outbox']))
{
$pagename "Outbox";
$tablefmt " ,Sent_to,Subject,Date";
$where "`sender` = $CURUSER[id] AND `location` IN ('out','both')";
$type "Mail";
}
elseif (isset(
$_GET['draft']))
{
$pagename "Draft";
$tablefmt " ,Sent_to,Subject,Date";
$where "`sender` = $CURUSER[id] AND `location` = 'draft'";
$type "Mail";
}
elseif (isset(
$_GET['templates']))
{
$pagename "Templates";
$tablefmt " ,Subject,Date";
$where "`sender` = $CURUSER[id] AND `location` = 'template'";
$type "Mail";
}
else
{
$pagename "Mail Overview";
$type "Overview";

Need to sqlesc($CURUSER[$id]) to secure I am just venting
Reply With Quote