Re: [otrs] Stats-Module and problems with @Params

26 Aug 2009

      Petrucci schrieb:
...
Hi,
    push (@Params, {
            Frontend => 'User',
            Name => 'User',
            Multiple => 0,
            Size => 0,
            Data => {
                %UserList,
            },
and in sub Run():
my $User = $Param{UserList};
but it fails, cause $User is empty, why?:
Because you said, that the selectbox has the name "User" and not
"UserList". You said it with "Name => 'User'"

BTW: You should not use the Variable in the SQL statement. Use the Bind
mechanism instead as this will improve security (any special characters
are quoted automatically).

Instead of

$Self->{DBObject}->Prepare(
  SQL => " ... UserLogin = $User"
);

do this:

$Self->{DBObject}->Prepare(
  SQL => " ... UserLogin = ?",
  Bind => [ \$User ],
);

Cheers,
Renée

-- 

Perl-Magazin: http://perl-magazin.de
Perl-Nachrichten: http://perl-nachrichten.de

Re: [otrs] Stats-Module and problems with @Params

Renee Bäcker