Language: Python
Label: safe
CWE: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.

Code:
    async def save_server(self, request):
        await self.elg(request)
        guild = self.bot.get_guild(int(request.match_info.get('server', '0')))
        if guild is None:
            self.notfound()
        if not guild.get_member(
            int(self.getsesh(request)['client']['id'])
        ).guild_permissions.administrator:
            self.notfound()
        data = await request.post()
        params = []
        otherparams = {}
        for k in data.keys():
            if not k.startswith('channel-'):
                otherparams[k] = ','.join(data.getall(k))
                continue
            param = {'channel_id': int(k[len('channel-'):])}
            for v in data.getall(k):
                v = v.partition('=')
                if v[0] == 'ping':
                    if 'ping' not in param:
                        param['ping'] = set()
                    param['ping'].add(v[-1])
                else:
                    param[v[0]] = v[-1] or None
            param['ping'] = '|'.join(param.get('ping', ())) or None
            params.append(param)
        otherparams['guild_id'] = guild.id
        if set(param['channel_id'] for param in params) \
                - set(channel.id for channel in guild.channels): # is not empty
            raise web.HTTPBadRequest
        try:
            with self.db.connection:
                self.db.executemany(
                    'UPDATE channels SET lang=:lang, games_ping=:ping \
WHERE channel_id=:channel_id',
                    params
                )
                self.db.execute(
                    'UPDATE guilds SET guild_disabled_commands=:disable_cmd, \
guild_disabled_cogs=:disable_cog, words_censor=:words_censor WHERE guild_id=:guild_id',
                    otherparams
                )
        except sql.ProgrammingError as exc:
            raise web.HTTPBadRequest(reason=str(exc))
        raise web.HTTPSeeOther(request.path)