From 0313606cf1077764a01d6089744bb3e8cf82cc6b Mon Sep 17 00:00:00 2001
From: Cyd <cyd@falloutshelterarcade.com>
Date: Wed, 1 Jul 2026 14:07:40 -0500
Subject: [PATCH] Harden getgroup.php: cast $_POST[group] to int

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 includes/getgroup.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/getgroup.php b/includes/getgroup.php
index 45da8c6..ebd7461 100644
--- a/includes/getgroup.php
+++ b/includes/getgroup.php
@@ -1,6 +1,6 @@
 <?php
 date_default_timezone_set('America/Chicago');
-if (isset($_POST['group'])) $group = $_POST['group'];
+$group = isset($_POST['group']) ? (int)$_POST['group'] : 0;
 
 $link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_error($link));
 mysqli_select_db($link, 'pqs') or die('Could not select database');