SQL Injection about pfsense-cp-auth-onestep

[deajan]

You're having a point.
I'll have to check whether pfSense 2.2.x also has mysqli support before considering this move.
While I cannot fix this in the next days, feel free to add a mysql_real_escape_string as a PR.

[keisentraut]

I've created a pull request which adds mysql_real_escape_string and checked that it is applied to all user input (even the MAC address), too. However mysql_real_escape_string is not sufficient in all edge cases, but for now should make exploitation much harder. Feel free to merge, but beware that I didn't test it yet.

[deajan]

Thanks for your work.
As soon as I can I'll rewrite this using proper statements.
Meanwhile, I merged your PR as it seems legit to me.

[deajan]

Finally got time to replace all the old mysql stuff with prepared statements. Done