From 30594b62f755674bfa05a503dfc074cc6354764f Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sat, 25 Jul 2026 19:12:03 +0900
Subject: [PATCH] treewide: avoid raw SQL concatenation

---
 www/admin/aktiviteter/delete.php | 3 ++-
 www/admin/prosjekter/delete.php  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/www/admin/aktiviteter/delete.php b/www/admin/aktiviteter/delete.php
index 796c2bd..56bc1d7 100644
--- a/www/admin/aktiviteter/delete.php
+++ b/www/admin/aktiviteter/delete.php
@@ -18,8 +18,9 @@ if (!$userManager->hasGroup($uname, 'aktiviteter')) {
 
 $eventID = $_GET['id'];
 
-$query = 'DELETE FROM events WHERE id=\'' . $eventID . '\'';
+$query = 'DELETE FROM events WHERE id=:id';
 $statement = $pdo->prepare($query);
+$statement->bindValue(':id', $eventID, \PDO::PARAM_INT);
 $statement->execute();
 
 header('Location: ' . $_SERVER['HTTP_REFERER']);
diff --git a/www/admin/prosjekter/delete.php b/www/admin/prosjekter/delete.php
index 84c67b4..51cb8c9 100644
--- a/www/admin/prosjekter/delete.php
+++ b/www/admin/prosjekter/delete.php
@@ -18,8 +18,9 @@ if (!$userManager->hasGroup($uname, 'prosjekt')) {
 
 $projectID = $_GET['id'];
 
-$query = 'DELETE FROM projects WHERE id=\'' . $projectID . '\'';
+$query = 'DELETE FROM projects WHERE id=:id';
 $statement = $pdo->prepare($query);
+$statement->bindValue(':id', $projectID, \PDO::PARAM_INT);
 $statement->execute();
 
 header('Location: ' . $_SERVER['HTTP_REFERER']);