Fix. Escape hostname string.

This commit is contained in:
Alexey Melnichuk
2015-08-25 16:49:56 +04:00
parent 65d1a77f7f
commit 55e3563191

View File

@@ -108,7 +108,7 @@ if ($_GET['a'] == "download") {
$sql = "select sip_profile_name from v_sip_profiles ";
$sql .= "where sip_profile_enabled = 'true' ";
if ($hostname) {
$sql .= "and (sip_profile_hostname = '" . $hostname . "' ";
$sql .= "and (sip_profile_hostname = '" . check_str($hostname) . "' ";
$sql .= "or sip_profile_hostname = '' ";
$sql .= "or sip_profile_hostname is null ) ";
}