hitoshura25/cvefixes huggingface dataset:
CVE-2017-20146 (Go, published 2022-12-27T22:15Z)
Description: value: Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/gorilla/handlers
Files changed:
cors.go
cors_test.go
Commit message: [bugfix] Don't return the origin header when configured to * (#116)

There's no reason to allow for a server to reflect all origin headers.
This has caused numerous security problems in the past.
 - https://github.com/cyu/rack-cors/issues/126
 - https://nodesecurity.io/advisories/148
 - https://github.com/captncraig/cors/commit/cc1cf75f5e3c06124602f2aa7893c8f3b1eef0b7

Some helpful blog posts on the topic:
 - https://ejj.io/misconfigured-cors/
 - http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html

Vulnerable code:
	w.Header().Set(corsAllowOriginHeader, origin)
	CORS(AllowedOriginValidator(originValidator))(testHandler).ServeHTTP(rr, r)

Fixed code:
	returnOrigin := origin
	for _, o := range ch.allowedOrigins {
		// A configuration of * is different than explicitly setting an allowed
		// origin. Returning arbitrary origin headers an an access control allow
		// origin header is unsafe and is not required by any use case.
		if o == corsOriginMatchAll {
			returnOrigin = "*"
			break
		}
	}
	w.Header().Set(corsAllowOriginHeader, returnOrigin)
	// Specially craft a CORS object.
	handleFunc := func(h http.Handler) http.Handler {
		c := &cors{
			allowedMethods: defaultCorsMethods,
			allowedHeaders: defaultCorsHeaders,
			allowedOrigins: []string{"http://a.example.com"},
			h:              h,
		}
		AllowedOriginValidator(originValidator)(c)
		return c
	}

	handleFunc(testHandler).ServeHTTP(rr, r)

func TestCORSAllowStar(t *testing.T) {
	r := newRequest("GET", "http://a.example.com")
	r.Header.Set("Origin", r.URL.String())
	rr := httptest.NewRecorder()

	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
	originValidator := func(origin string) bool {
		if strings.HasSuffix(origin, ".example.com") {
			return true
		}
		return false
	}

	CORS(AllowedOriginValidator(originValidator))(testHandler).ServeHTTP(rr, r)
	header := rr.HeaderMap.Get(corsAllowOriginHeader)
	// Because * is the default CORS policy (which is safe), we should be
	// expect a * returned here as the Access Control Allow Origin header
	if header != "*" {
		t.Fatalf("bad header: expected %s to be %s, got %s.", corsAllowOriginHeader, r.URL.String(), header)
	}

}
CVE-2021-32684 (JavaScript, published 2021-06-14T23:15Z)
Description: value: magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-670 \u2014 Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Repository: https://github.com/scandipwa/create-magento-app
Files changed:
build-packages/magento-scripts/lib/commands/execute.js
build-packages/magento-scripts/lib/commands/logs.js
Commit message: fixed exec and logs command throwing an error with docker.getContainers


Vulnerable code:
        const containers = docker.getContainers();
            const containers = docker.getContainers();

Fixed code:
        const containers = (await docker).getContainers();
            const containers = (await docker).getContainers();
CVE-2020-5233 (Unknown, published 2020-01-30T19:15Z)
Description: value: OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/pusher/oauth2_proxy
Files changed:
Commit message: Merge pull request from GHSA-qqxw-m5fj-f7gv

check for /\ redirects

Vulnerable code:

Fixed code:
CVE-2022-2651 (Unknown, published 2022-08-04T09:15Z)
Description: value: Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-305 \u2014 Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Repository: https://github.com/bookwyrm-social/bookwyrm
Files changed:
Commit message: Merge pull request #2230 from bookwyrm-social/nginx-rate-limit

Adds rate limiting to some views in nginx

Vulnerable code:

Fixed code:
CVE-2022-31136 (Unknown, published 2022-07-07T18:15Z)
Description: value: Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bookwyrm-social/bookwyrm
Files changed:
Commit message: Merge pull request #2173 from bookwyrm-social/html-sanitizer

Html sanitizer

Vulnerable code:

Fixed code:
CVE-2015-8863 (C, published 2016-05-06T17:59Z)
Description: value: Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/stedolan/jq
Files changed:
src/jv_parse.c
Commit message: Heap buffer overflow in tokenadd() (fix #105)

This was an off-by one: the NUL terminator byte was not allocated on
resize.  This was triggered by JSON-encoded numbers longer than 256
bytes.


Vulnerable code:
  if (p->tokenpos == p->tokenlen) {
    p->tokenbuf[p->tokenpos] = 0; // FIXME: invalid

Fixed code:
  if (p->tokenpos >= (p->tokenlen - 1)) {
    p->tokenbuf[p->tokenpos] = 0;
CVE-2021-4124 (JavaScript, published 2021-12-16T14:15Z)
Description: value: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/meetecho/janus-gateway
Files changed:
html/textroomtest.js
Commit message: Fixed missing XSS mitigation (see #2817)


Vulnerable code:
					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result);

Fixed code:
					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result));
CVE-2022-4768 (Python, published 2022-12-27T23:15Z)
Description: value: A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/dropbox/merou
Files changed:
grouper/public_key.py
tests/constants.py
tests/public_key_test.py
Commit message: Block injection attack in ssh public key handling (#673)

Also needed to fix the setup a bit to address a version incompatibility

Vulnerable code:
from tests.constants import SSH_KEY_1, SSH_KEY_BAD

Fixed code:
    # Allowing newlines can lead to injection attacks depending on how the key is
    # consumed, such as if it's dumped in an authorized_keys file with a `command`
    # restriction.
    # Note parsing the key is insufficient to block this.
    if "\r" in public_key_str or "\n" in public_key_str:
        raise PublicKeyParseError("Public key cannot have newlines")

SSH_KEY_BAD_MULTILINE = SSH_KEY_1 + "\r" + SSH_KEY_2

SSH2_KEY_BAD = """\
---- BEGIN SSH2 PUBLIC KEY ----
foobar: this is a chance to hide bad things
AAAAC3NzaC1lZDI1NTE5AAAAIJ5O/AXibtVhySDYn60ATXftAU1oCe4BQubFYoV2juEb
---- END SSH2 PUBLIC KEY ----
"""

from tests.constants import SSH2_KEY_BAD, SSH_KEY_1, SSH_KEY_BAD, SSH_KEY_BAD_MULTILINE
@pytest.mark.parametrize("key", [SSH_KEY_BAD_MULTILINE, SSH2_KEY_BAD])
def test_multiline_key(key, session, users):  # noqa: F811
    user = users["cbguder@a.co"]

    with pytest.raises(PublicKeyParseError, match="Public key cannot have newlines"):
        add_public_key(session, user, key)

    assert get_public_keys_of_user(session, user.id) == []
CVE-2020-19678 (PHP, published 2023-04-06T18:15Z)
Description: value: Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pfsense/pfsense-packages
Files changed:
config/suricata/suricata_logs_browser.php
Commit message: Fix file browser vulnerability on LOGS BROWSER tab.


Vulnerable code:
$suricatalogdir = SURICATALOGDIR . "suricata_{$if_real}{$suricata_uuid}";
$logfile = $_POST['file'];
	if(!is_file($_POST['file'])) {
		$data = file_get_contents($_POST['file']);
			echo "|0|{$_POST['file']}|{$data}|";	
					echo "<option value='{$suricatalogdir}/{$log}' {$selected}>" . $log . "</option>\n";
<?php if(empty($logfile)): ?>

Fixed code:
$suricatalogdir = SURICATALOGDIR . "suricata_{$if_real}{$suricata_uuid}/";
// Limit all file access to just the currently selected interface's logging subdirectory
$logfile = htmlspecialchars($suricatalogdir . basename($_POST['file']));
	if(!is_file($logfile)) {
		$data = file_get_contents($logfile);
			echo "|0|{$logfile}|{$data}|";	
					echo "<option value='{$suricatalogdir}{$log}' {$selected}>" . $log . "</option>\n";
<?php if(empty($_POST['file'])): ?>
CVE-2021-23807 (Unknown, published 2021-11-03T18:15Z)
Description: value: This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/janl/node-jsonpointer
Files changed:
Commit message: Merge pull request #51 from dellalibera/fix-prototype-pollution

fix-prototype-pollution

Vulnerable code:

Fixed code:
CVE-2016-6255 (Other, published 2017-03-07T16:59Z)
Description: value: Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/mjg59/pupnp-code
Files changed:
configure.ac
upnp/inc/upnpconfig.h.in
upnp/src/genlib/net/http/webserver.c
Commit message: Don't allow unhandled POSTs to write to the filesystem by default

If there's no registered handler for a POST request, the default behaviour
is to write it to the filesystem. Several million deployed devices appear
to have this behaviour, making it possible to (at least) store arbitrary
data on them. Add a configure option that enables this behaviour, and change
the default to just drop POSTs that aren't directly handled.


Vulnerable code:

Fixed code:
RT_BOOL_ARG_ENABLE([postwrite], [no], [write to the filesystem on otherwise unhandled POST requests])
if test "x$enable_postwrite" = xyes ; then
        AC_DEFINE(UPNP_ENABLE_POST_WRITE, 1, [see upnpconfig.h])
fi
/** Defined to 1 if the library has been compiled to support filesystem writes on POST
 *  (i.e. configure --enable-postwrite) */
#undef UPNP_ENABLE_POST_WRITE


#ifdef UPNP_ENABLE_POST_WRITE
#else
		return HTTP_NOT_FOUND;
#endif
CVE-2018-18635 (PHP, published 2018-10-24T21:29Z)
Description: value: www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MailCleaner/MailCleaner
Files changed:
www/guis/admin/application/controllers/UserController.php
Commit message: Bug fix - Issue #53

Bug fix of a XSS issue on MailCleaner login (administration) interface. See issue #53 
The "message" parameter was only used for the logoutAction(). However, the parameter was not checked and not escaped.

Vulnerable code:
        if ($this->getRequest()->getParam('message')) {
        	$form->addErrorMessage($this->getRequest()->getParam('message'));

Fixed code:
        
        // Display only loggedOut message
        if ($this->getRequest()->getParam('message') == "loggedOut") {
        	$form->addErrorMessage(htmlspecialchars($this->getRequest()->getParam('message')));
CVE-2019-1010246 (PHP, published 2019-07-18T19:15Z)
Description: value: MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/MailCleaner/MailCleaner
Files changed:
www/guis/users/application/controllers/NewslettersController.php
Commit message: Update NewslettersController.php

Test if an Exim ID was passed.

Vulnerable code:

Fixed code:
	
	if (strlen($eximId) == 0) { die(); }
CVE-2017-6905 (PHP, published 2017-03-15T00:59Z)
Description: value: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/concrete5/concrete5-legacy
Files changed:
web/concrete/tools/files/search_dialog.php
Commit message: Fix #1947

Vulnerable code:
if (isset($_REQUEST['disable_choose']) && $_REQUEST['disable_choose'] == 1) { 
	<input type="hidden" name="dialogAction" value="<?=REL_DIR_FILES_TOOLS_REQUIRED?>/files/search_dialog?ocID=<?=$_REQUEST['ocID']?>&searchInstance=<?=$searchInstance?>&disable_choose=<?=$_REQUEST['disable_choose']?>" />
?>

Fixed code:
$disable_choose = Loader::helper('text')->entities($_REQUEST['disable_choose']);
if ($disable_choose == 1) { 
	<input type="hidden" name="dialogAction" value="<?=REL_DIR_FILES_TOOLS_REQUIRED?>/files/search_dialog?ocID=<?=$ocID?>&amp;searchInstance=<?=$searchInstance?>&amp;disable_choose=<?=$disable_choose?>" />
?>
CVE-2017-6908 (PHP, published 2017-03-15T00:59Z)
Description: value: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/concrete5/concrete5-legacy
Files changed:
web/concrete/tools/files/selector_data.php
Commit message: Fix #1948

Vulnerable code:
$f = File::getByID($_REQUEST['fID']);
<div class="ccm-file-selected" fID="<?=$_REQUEST['fID']?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
</div>

Fixed code:
$fID = Loader::helper('text')->entities($_REQUEST['fID']);
$f = File::getByID($fID);
<div class="ccm-file-selected" fID="<?=$fID?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
</div>
CVE-2015-10031 (PHP, published 2023-01-08T17:15Z)
Description: value: A vulnerability classified as critical was found in purpleparrots 491-Project. This vulnerability affects unknown code of the file update.php of the component Highscore Handler. The manipulation leads to sql injection. The name of the patch is a812a5e4cf72f2a635a716086fe1ee2b8fa0b1ab. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217648.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/purpleparrots/491-Project
Files changed:
update.php
Commit message: fixed update.php to prevent sql injections because people are douchebags


Vulnerable code:
	$name = $_GET["name"];
	$score = $_GET["score"];
	$username = "alpertmd";
	$password = "yofer`";
	$hostname = "repos.insttech.washington.edu";
	$dbhandle = mysql_connect($hostname, $username, $password) or die("Unable to connect to MySQL");

	$selected = mysql_select_db("alpertmd", $dbhandle) or die("Could not select high score db");
	$result = mysql_query("SELECT MAX(idHighscores) FROM Highscores");
	$id = mysql_result($result, 0) + 1;
	$query = "INSERT INTO Highscores VALUES ($id, '$name', $score)";
	$result = mysql_query($query);
		
	$query = "SELECT idHighscores FROM Highscores WHERE score = (SELECT Min(score) FROM Highscores)";
	$result = mysql_query($query);
	$minID = mysql_result($result, 0);
	$query = "DELETE FROM Highscores WHERE idHighscores = $minID";
	$result = mysql_query($query);
	mysql_close($dbhandle);

Fixed code:
	if ($_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest'){
		$username = "alpertmd";
		$password = "yofer`";
		$hostname = "repos.insttech.washington.edu";
		$dbhandle = mysqli_connect($hostname, $username, $password) or die("Unable to connect to MySQL");
		$selected = mysqli_select_db($dbhandle,$username) or die("Could not select high score db");
		$result = mysqli_query($dbhandle, "SELECT MAX(idHighscores) FROM Highscores");
	
		$id = mysqli_fetch_row($result)[0] + 1;
		$name = $_POST["name"];
		$score = $_POST["score"];
		$query =  mysqli_prepare($dbhandle, "INSERT INTO Highscores Values (?, ?, ?)");
	
		mysqli_stmt_bind_param($query, 'isi', $id, $name, $score);
		mysqli_stmt_execute($query);
		mysqli_stmt_close($query);
		
		$query = "SELECT idHighscores FROM Highscores WHERE score = (SELECT Min(score) FROM Highscores)";
		$result = mysqli_query($dbhandle, $query);
		$minID = mysqli_fetch_row($result)[0];
		$query = "DELETE FROM Highscores WHERE idHighscores = $minID";
		$result = mysqli_query($dbhandle, $query);
		mysqli_close($dbhandle);
	}