Avoid SQL Injection

pro-prodipto · Mar 23, 2019 · ac77137 · ac77137
1 parent b739ad0
commit ac77137
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/objects/bootGrid.php b/objects/bootGrid.php
@@ -21,7 +21,7 @@ static function getSqlFromPost($searchFieldsNames = array(), $keyPrefix = "", $a
  if(strtoupper($value)==="DESC"){
  $direction = "DESC";
  }
- $key = preg_replace("/[^A-Za-z0-9 ]/", '', $key);
+ $key = preg_replace("/[^A-Za-z0-9._ ]/", '', $key);
  $orderBy[] = " {$keyPrefix}{$key} {$direction} ";
  }
  $sql .= " ORDER BY ".implode(",", $orderBy);