diff --git a/app/db_connector.php b/app/db_connector.php index 734b7a2..46c288d 100755 --- a/app/db_connector.php +++ b/app/db_connector.php @@ -9,9 +9,16 @@ } function get_images($pdo, $search='%', $sort='img_date', $sdir='DESC') { - $params = array('search' => $search, 'sort' => $sort, 'sdir' => $sdir); - $stmt = $pdo->prepare("SELECT * FROM images WHERE img_title LIKE CONCAT('%', :search ,'%') ORDER BY :sort :sdir;"); + if ($sort != 'img_date' && $sdir != 'ASC') { + if ($sort != 'img_title' && $sdir != 'DESC') { + echo('Ey boss, database request is kinda f*cked up. Maybe you want to try that again, hey...
'.$sort.' '.$sdir); + die(); + } + } + $params = array('search' => $search); + $stmt = $pdo->prepare("SELECT * FROM images WHERE img_title LIKE CONCAT('%', :search ,'%') ORDER BY $sort $sdir;"); $stmt->execute($params); + // $stmt->debugDumpParams(); $data = $stmt->fetchAll(); $img_list = '