From 01fab8136ef9bbdd36e80ca8157be66cea10181a Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Thu, 26 Mar 2026 01:32:14 +0000
Subject: [PATCH] =?UTF-8?q?git=20commit=20-am=20"[KVE-2026-0330]=EC=98=81?=
 =?UTF-8?q?=EC=B9=B4=ED=8A=B8=5FSQL=5FInjection=EC=B7=A8=EC=95=BD=EC=A0=90?=
 =?UTF-8?q?=5F=EC=88=98=EC=A0=95";?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mobile/shop/itemqalist.php  | 5 +++++
 mobile/shop/itemuselist.php | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/mobile/shop/itemqalist.php b/mobile/shop/itemqalist.php
index 23a48f87f..99b4fc76d 100644
--- a/mobile/shop/itemqalist.php
+++ b/mobile/shop/itemqalist.php
@@ -7,6 +7,11 @@ include_once(G5_MSHOP_PATH.'/_head.php');
 $sql_common = " from `{$g5['g5_shop_item_qa_table']}` a join `{$g5['g5_shop_item_table']}` b on (a.it_id=b.it_id) ";
 $sql_search = " where (1) ";
 
+if( isset($sfl) && ! in_array($sfl, array('b.it_name', 'a.it_id', 'a.iq_subject', 'a.iq_question', 'a.iq_name', 'a.mb_id')) ){
+    //다른값이 들어가있다면 초기화
+    $sfl = '';
+}
+
 if(!$sfl)
     $sfl = 'b.it_name';
 
diff --git a/mobile/shop/itemuselist.php b/mobile/shop/itemuselist.php
index 02f32fde5..0a017004c 100644
--- a/mobile/shop/itemuselist.php
+++ b/mobile/shop/itemuselist.php
@@ -7,6 +7,11 @@ include_once(G5_MSHOP_PATH.'/_head.php');
 $sql_common = " from `{$g5['g5_shop_item_use_table']}` a join `{$g5['g5_shop_item_table']}` b on (a.it_id=b.it_id) ";
 $sql_search = " where a.is_confirm = '1' ";
 
+if( isset($sfl) && ! in_array($sfl, array('b.it_name', 'a.it_id', 'a.is_subject', 'a.is_content', 'a.is_name', 'a.mb_id')) ){
+    //다른값이 들어가있다면 초기화
+    $sfl = '';
+}
+
 if(!$sfl)
     $sfl = 'b.it_name';