- GUI made immune to SQL injection attacks (Alexei)

git-svn-id: svn://svn.zabbix.com/trunk@2600 97f52cf1-0a1b-0410-bd0e-c28be96e8082

1 files changed, 3 insertions, 3 deletions

diff --git a/frontends/php/overview.php b/frontends/php/overview.php
index 25b5411d..f2af4e9c 100644
--- a/frontends/php/overview.php
+++ b/frontends/php/overview.php
@@ -153,7 +153,7 @@
 			$rows=array(nbsp($row["description"]));
 			foreach($hosts as $hostid)
 			{
-				$sql="select itemid,value_type,lastvalue,units from items where hostid=$hostid and description='".$row["description"]."'";
+				$sql="select itemid,value_type,lastvalue,units from items where hostid=$hostid and description='".zbx_ads($row["description"])."'";
 				$result2=DBselect($sql);
 				if(DBnum_rows($result2)==1)
 				{
@@ -224,14 +224,14 @@
 			$_REQUEST["sort"]="order by i.description";
 		}
 //		$sql="select distinct description from items order by 1;";
-		$sql="select distinct t.description from hosts h,items i,hosts_groups hg,triggers t,functions f where h.status=".HOST_STATUS_MONITORED." and t.status=".TRIGGER_STATUS_ENABLED." and h.hostid=i.hostid and hg.groupid=".zbx_ads($_REQUEST["groupid"])." and hg.hostid=h.hostid and t.triggerid=f.triggerid and f.itemid=i.itemid order by 1";
+		$sql="select distinct t.description from hosts h,items i,hosts_groups hg,triggers t,functions f where h.status=".HOST_STATUS_MONITORED." and t.status=".TRIGGER_STATUS_ENABLED." and h.hostid=i.hostid and hg.groupid=".$_REQUEST["groupid"]." and hg.hostid=h.hostid and t.triggerid=f.triggerid and f.itemid=i.itemid order by 1";
 		$result=DBselect($sql);
 		while($row=DBfetch($result))
 		{
 			$rows=array(nbsp($row["description"]));
 			foreach($hosts as $hostid)
 			{
-				$sql="select t.status,t.value,t.lastchange from triggers t,functions f,items i where f.triggerid=t.triggerid and i.itemid=f.itemid and t.status=".TRIGGER_STATUS_ENABLED." and i.hostid=".zbx_ads($hostid)." and t.description='".zbx_ads($row["description"])."'";
+				$sql="select t.status,t.value,t.lastchange from triggers t,functions f,items i where f.triggerid=t.triggerid and i.itemid=f.itemid and t.status=".TRIGGER_STATUS_ENABLED." and i.hostid=$hostid and t.description='".zbx_ads($row["description"])."'";
 				$result2=DBselect($sql);
 				if(DBnum_rows($result2)==1)
 				{