From e2b75bcca9c93a8ba665eb7b8ff65a26a51089c0 Mon Sep 17 00:00:00 2001
From: alex <karpen_ko@hotmail.com>
Date: Fri, 13 Dec 2019 16:37:33 +0100
Subject: [PATCH] - system/Variablenname_model getDefaults: replaced string
 concatenation of variable names in query by ci parameter replacement to
 prevent SQL injections

---
 application/models/system/Variablenname_model.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/application/models/system/Variablenname_model.php b/application/models/system/Variablenname_model.php
index ada1d330c..7b2a2cf88 100644
--- a/application/models/system/Variablenname_model.php
+++ b/application/models/system/Variablenname_model.php
@@ -27,7 +27,7 @@ class Variablenname_model extends DB_Model
 	/**
 	 * Gets defaults for user variables.
 	 * If no default value present in table, SQL can be executed for retrieving the value.
-	 * @param null $names optionally get only defaults for certain variables
+	 * @param $names optionally get only defaults for certain variables
 	 * @return array
 	 */
 	public function getDefaults($names = null)
@@ -36,13 +36,13 @@ class Variablenname_model extends DB_Model
 
 		$qry = "SELECT name, defaultwert FROM public.tbl_variablenname";
 
-		if (isset($names) && is_array($names))
+		if (!isEmptyArray($names))
 		{
-			$qry .= " WHERE name IN ('".implode(',', $names)."')";
+			$qry .= " WHERE name IN ?";
 		}
 		$qry .= ";";
 
-		$defaultsres = $this->execQuery($qry);
+		$defaultsres = $this->execQuery($qry, array('name' => $names));
 
 		if (hasData($defaultsres))
 		{