innls/Blue-Economics — pull request #33 by jakubzapletal (2014-07-06 22:22:05+00:00)
Title: Repair jobs API

Fix #22

Hey guys, I saw an issue about jobs API so I have repaired it.

I have also done a few changes:
* Somewhere API returns HTML and somewhere JSON. The correct way is JSON so have edited APIs to return JSON and adjusted Javascript file to accept JSON format.
* I have seen a really fatal error. There was a SQL query in search API which injected a value directly from URL query parameters to the SQL query string variable. It was a nice place where we could be attacked by SQL injection. For example try to search API send request with "' ); DROP DATABASE blueeconomics; SELECT CONCAT(0, '" and guess what has happened :-) Who doesn't know SQL, it REMOVE whole database. (The exact example of query is "/search/%27%20)%3B%20DROP%20DATABASE%20blueeconomics%3B%20SELECT%20CONCAT(0%2C%20%27". So I have improved it.

I have a question for job_description API. Why does this API get as value a name of job instead of job's id?

Please do code review if you do and let me know. Thanks