From 2b04a0339c3ba7fa3853df20569559cf0d32c76c Mon Sep 17 00:00:00 2001
From: "mheitzenroder@gmail.com" <mheitzenroder@gmail.com>
Date: Sat, 15 Sep 2007 05:02:14 +0000
Subject: [PATCH] Bug 50 - SQL injection exploit, resolved by checking for
 valid post id

---
 index.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/index.php b/index.php
index 9e2b8aa..cec60c3 100644
--- a/index.php
+++ b/index.php
@@ -42,6 +42,9 @@
 
         if (isset($_GET["post"])) {
                 $id_post = $_GET["post"];
+                if (!is_numeric($id_post) && $id_post < 1 ){
+                	header("Location: index.php");
+                }
         } else {
                 if (isset($param_url[1]) && $param_url[1]=="post") {
                         $id_post = (isset($param_url[2])) ? ((is_numeric($param_url[2])) ? $param_url[2] : NULL) : NULL;