Merge pull request #32 from rfschmid/fix-sql-injection

2026-08-09 10:23:22 +02:00 · 2025-01-17 11:38:43 -08:00
parent fac22aee91 54ec4009a1
commit 550556df2b
1 changed files with 6 additions and 5 deletions
@@ -53,12 +53,13 @@ def update_ack_nak(channel, timestamp, message, ack):
            db_cursor = db_connection.cursor()
            update_query = f"""
                UPDATE {get_table_name(channel)}
-                SET ack_type = '{ack}'
-                WHERE user_id = {str(globals.myNodeNum)} AND
-                      timestamp = {timestamp} AND
-                      message_text = '{message}'
+                SET ack_type = ?
+                WHERE user_id = ? AND
+                      timestamp = ? AND
+                      message_text = ?
            """
-            db_cursor.execute(update_query)
+
+            db_cursor.execute(update_query, (ack, str(globals.myNodeNum), timestamp, message))
            db_connection.commit()

    except sqlite3.Error as e: