fin du passage à sqlite et preotection des injections

referant/cible/export.php

@@ -1,9 +1,7 @@
 <?php
 
 $bdd = new SQLite3('../../database/ticket_panne.db', SQLITE3_OPEN_READWRITE);
-$stmt = $bdd->prepare('SELECT * FROM :base');
-$stmt->bindParam(':base', $_POST['bdd']);
-$res = $stmt->execute();
+$res = $bdd->query('SELECT * FROM ' .$_POST['bdd']);
 $title = array_keys($res->fetchArray(SQLITE3_ASSOC));
 
 header('Content-Type: text/csv; charset=utf-8');
@@ -11,7 +9,7 @@ header('Content-Disposition: attachment; filename=' .$_POST['bdd'] .'.csv');
 $output = fopen("php://output", "w");
 fputcsv($output, $title);
 
-while($row = $stmt->fetchArray(SQLITE3_ASSOC)) {
+while($row = $res->fetchArray(SQLITE3_ASSOC)) {
     fputcsv($output, $row);
 }
 fclose($output);

referant/cible/search.php

@@ -3,8 +3,7 @@ $bdd = new SQLite3('../../database/ticket_panne.db', SQLITE3_OPEN_READWRITE);
 
 try {
     // $reponse = $bdd->query("SELECT * FROM pannes WHERE `" .$_POST['champ'] ."`='" .$_POST['value'] ."'");
-    $reponse = $bdd->prepare("SELECT * FROM pannes WHERE :champ=:value");
-    $reponse->bindParam(':champ', $_POST['champ']);
+    $reponse = $bdd->prepare("SELECT * FROM pannes WHERE ".$_POST['champ'] ."=:value");
     $reponse->bindValue(':value', $_POST['value']);
     $fetch = $reponse->execute();
     $result = [];