* Escape data in sql query

centreon · Nov 27, 2014 · d00f3e0 · d00f3e0
1 parent 015e875
commit d00f3e0
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/www/class/centreonAuth.class.php b/www/class/centreonAuth.class.php
@@ -223,10 +223,11 @@ protected function checkPassword($password, $token = "", $autoimport = false) {
      * @return void
      */
     protected function checkUser($username, $password, $token) {
+        $usernameForQuery = $this->pearDB->escape($username, true);
         if ($this->autologin == 0 || ($this->autologin && $token != "")) {
-            $DBRESULT = $this->pearDB->query("SELECT * FROM `contact` WHERE `contact_alias` = '" . htmlentities($username, ENT_QUOTES, "UTF-8") . "' AND `contact_activate` = '1' AND `contact_register` = '1' LIMIT 1");
+            $DBRESULT = $this->pearDB->query("SELECT * FROM `contact` WHERE `contact_alias` = '" . $usernameForQuery . "' AND `contact_activate` = '1' AND `contact_register` = '1' LIMIT 1");
         } else {
-            $DBRESULT = $this->pearDB->query("SELECT * FROM `contact` WHERE MD5(contact_alias) = '" . htmlentities($username, ENT_QUOTES, "UTF-8") . "' AND `contact_activate` = '1' AND `contact_register` = '1' LIMIT 1");
+            $DBRESULT = $this->pearDB->query("SELECT * FROM `contact` WHERE MD5(contact_alias) = '" . $usernameForQuery . "' AND `contact_activate` = '1' AND `contact_register` = '1' LIMIT 1");
         }
         if ($DBRESULT->numRows()) {
             $this->userInfos = $DBRESULT->fetchRow();
@@ -264,7 +265,7 @@ protected function checkUser($username, $password, $token) {
             /*
              * Reset userInfos with imported informations
              */
-            $DBRESULT = $this->pearDB->query("SELECT * FROM `contact` WHERE `contact_alias` = '" . htmlentities($username, ENT_QUOTES, "UTF-8") . "' AND `contact_activate` = '1' AND `contact_register` = '1' LIMIT 1");
+            $DBRESULT = $this->pearDB->query("SELECT * FROM `contact` WHERE `contact_alias` = '" . $usernameForQuery . "' AND `contact_activate` = '1' AND `contact_register` = '1' LIMIT 1");
             if ($DBRESULT->numRows()) {
                 $this->userInfos = $DBRESULT->fetchRow();
             }