From b89bfccd56f1f8d24f66afd6921a2b7b8dc4a9f2 Mon Sep 17 00:00:00 2001
From: mauirixxx <mauirixxx@users.noreply.github.com>
Date: Thu, 18 May 2017 00:53:44 -1000
Subject: [PATCH] first attempt at input sanitation

---
 gw-pull.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gw-pull.php b/gw-pull.php
index dc2a609..dacc39f 100644
--- a/gw-pull.php
+++ b/gw-pull.php
@@ -1,7 +1,7 @@
 <?php
-$cnameid = $_GET['toonid']; //need to sanitize this input somehow
 include_once 'gw-connect.php';
 $con = new mysqli(DATABASE_HOST, DATABASE_USER, DATABASE_PASS, DATABASE_NAME);
+$cnameid = mysqli_real_escape_string($con, $_GET['toonid']); //need to sanitize this input somehow
 if ($con->connect_errno > 0){
 	die ('Unable to connect to database [' . $db->connect_errno . ']');
 }
@@ -20,7 +20,7 @@ if (mysqli_num_rows($result) > 0) {
 			} else {
 				echo 'a ' . $row['material'] . '!<BR />';
 			}
-		} //add another else statement to cover RUNES here. or up there.
+		}
 	}
 } else {
 	echo 'no data to display for that character';