Explicit SQL injection protection

Flerex · Jun 29, 2020 · af7e64c · af7e64c
1 parent e7fc348
commit af7e64c
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/service/auth_service.php b/service/auth_service.php
@@ -176,7 +176,7 @@ public function get_ip_login_attempts(): int
 	 */
 	public function add_login_attempt_for_user(int $user_id): void
 	{
-		$sql = 'UPDATE ' . USERS_TABLE . ' SET user_login_attempts = user_login_attempts + 1 WHERE user_id = ' . $user_id;
+		$sql = 'UPDATE ' . USERS_TABLE . ' SET user_login_attempts = user_login_attempts + 1 WHERE user_id = ' . (int) $user_id;
 		$this->db->sql_query($sql);
 	}
 
@@ -187,7 +187,7 @@ public function add_login_attempt_for_user(int $user_id): void
 	 */
 	public function restore_login_attempt_for_user(int $user_id): void
 	{
-		$sql = 'UPDATE ' . USERS_TABLE . ' SET user_login_attempts = 0 WHERE user_id = ' . $user_id;
+		$sql = 'UPDATE ' . USERS_TABLE . ' SET user_login_attempts = 0 WHERE user_id = ' . (int) $user_id;
 		$this->db->sql_query($sql);
 	}
 
@@ -222,7 +222,7 @@ public function add_ip_login_attempt(string $username, int $user_id = 0): void
 	 */
 	public function remove_ip_login_attempt_for_user(int $user_id = 0): void
 	{
-		$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . ' WHERE user_id = ' . $user_id;
+		$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . ' WHERE user_id = ' . (int) $user_id;
 		$this->db->sql_query($sql);
 	}