Snitz Forums 2000 - Save extra call to chkString() in password.asp

Snitz Forums 2000

Username:	Password:
Save Password
Forgot your Password?

All Forums

Snitz Forums 2000 DEV-Group

DEV Bug Reports (Closed)

Save extra call to chkString() in password.asp

Forum Locked

Topic Locked

Printer Friendly

Author

Topic

Davio
Development Team Member

Jamaica
12217 Posts

Posted - 03 October 2006 : 05:20:32

In password.asp, line 115 to 124 is as follows:

if Err_Msg = "" then
	strEncodedPassword = sha256("" & Request.Form("Password"))
	pwkey = ""

	'Update the user's password
	strSql = "UPDATE " & strMemberTablePrefix & "MEMBERS "
	strSql = strSql & " SET M_PASSWORD = '" & chkString(strEncodedPassword,"SQLString") & "'"
	strSql = strSql & ", M_PWKEY = '" & chkString(pwkey,"SQLString") & "'"
	strSql = strSql & " WHERE MEMBER_ID = " & cLng(Request.Form("MEMBER_ID"))
	strSql = strSql & " AND M_PWKEY = '" & key & "'"

	my_Conn.Execute (strSql),,adCmdText + adExecuteNoRecords
else

The variable pwkey is set to an empty string before being password to the sql query. This empty variable is put through chkString() function which is not needed.

Suggest changing line 120 to: