From a97ee8fb2a8a76df28052c4bb77e542c1191b342 Mon Sep 17 00:00:00 2001
From: Florian Sylvain <floriansylvainpro@gmail.com>
Date: Sat, 30 Oct 2021 18:12:01 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20getTheseByAuthor()=20no?=
 =?UTF-8?q?w=20sanitize=20author=20name?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ProjetProgWeb/class/dump.php | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/ProjetProgWeb/class/dump.php b/ProjetProgWeb/class/dump.php
index 45cd44c..b6395f7 100644
--- a/ProjetProgWeb/class/dump.php
+++ b/ProjetProgWeb/class/dump.php
@@ -24,12 +24,18 @@ class dump {
 
         $pdo_obj = new conf();
         $pdo = $pdo_obj->getPDO();
-        $stmt = $pdo->query("SELECT * FROM theses WHERE author LIKE '%$author%';");
+
+        $author = '%' . $author . '%';
+
+        $stmt = $pdo->prepare("SELECT * FROM theses WHERE author LIKE :author;");
+        $stmt->bindParam(':author', $author, PDO::PARAM_STR, 100);
+        $stmt->execute();
+
         $i = 0;
         while ($obj = $stmt->fetchObject()) {
             $theses_array[$i] = array();
             foreach ($obj as $elem) {
-                array_push($theses_array[$i], empty($elem) ? "NULL" : $elem);
+                array_push($theses_array[$i], empty($elem) ? "Non définit" : $elem);
             }
             $i++;
         }