Index: /extensions/Copyrights/admin.php
===================================================================
--- /extensions/Copyrights/admin.php	(revision 10930)
+++ /extensions/Copyrights/admin.php	(revision 10931)
@@ -1,3 +1,24 @@
 <?php
+// +-----------------------------------------------------------------------+
+// | Piwigo - a PHP based picture gallery                                  |
+// +-----------------------------------------------------------------------+
+// | Copyright(C) 2008-2009 Piwigo Team                  http://piwigo.org |
+// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
+// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
+// +-----------------------------------------------------------------------+
+// | This program is free software; you can redistribute it and/or modify  |
+// | it under the terms of the GNU General Public License as published by  |
+// | the Free Software Foundation                                          |
+// |                                                                       |
+// | This program is distributed in the hope that it will be useful, but   |
+// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
+// | General Public License for more details.                              |
+// |                                                                       |
+// | You should have received a copy of the GNU General Public License     |
+// | along with this program; if not, write to the Free Software           |
+// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
+// | USA.                                                                  |
+// +-----------------------------------------------------------------------+
 
 if (!defined("PHPWG_ROOT_PATH")){
@@ -22,12 +43,13 @@
 if (isset($_GET['tab'])) {
   if ($_GET['tab'] == 'create') {
-    $name = $_REQUEST['name'];
-    $url = $_REQUEST['url'];
+    $name = pwg_db_real_escape_string($_REQUEST['name']);
+    $url = pwg_db_real_escape_string($_REQUEST['url']);
     $visible = (isset($_REQUEST['visible']) ? 1 : 0);
-    $query = '
-      INSERT INTO '.COPYRIGHTS_ADMIN.'
+    $query = sprintf(
+      'INSERT INTO %s
       (`name`,`url`,`visible`) VALUES
-      ("'.$name.'","'.$url.'",'.$visible.')
-      ;';
+      ("%s","%s",%d)
+      ;',
+      COPYRIGHTS_ADMIN, $name, $url, $visible);
     pwg_query($query);
   }
@@ -36,9 +58,10 @@
     $edit = 1;
     $CRid = $_REQUEST['id'];
-    $query = '
-      SELECT *
-      FROM '.COPYRIGHTS_ADMIN.'
-      WHERE `cr_id`='.$CRid.'
-      ;';
+    $query = sprintf(
+      'SELECT *
+      FROM %s
+      WHERE `cr_id`=%d
+      ;',
+      COPYRIGHTS_ADMIN, $CRid);
     $result = pwg_query($query);
     $row = pwg_db_fetch_assoc($result);
@@ -49,13 +72,14 @@
 
   if ($_GET['tab'] == 'update') {
-    $id = $_REQUEST['id'];
-    $name = $_REQUEST['name'];
-    $url = $_REQUEST['url'];
+    $id = pwg_db_real_escape_string($_REQUEST['id']);
+    $name = pwg_db_real_escape_string($_REQUEST['name']);
+    $url = pwg_db_real_escape_string($_REQUEST['url']);
     $visible = (isset($_REQUEST['visible']) ? 1 : 0);
-    $query = '
-      UPDATE '.$prefixeTable.'copyrights_admin
-      SET `name`="'.$name.'", `url`="'.$url.'", `visible`='.$visible.'
-      WHERE `cr_id`='.$id.'
-      ;';
+    $query = sprintf(
+      'UPDATE %s
+      SET `name`="%s", `url`="%s", `visible`=%d
+      WHERE `cr_id`=%d
+      ;',
+      COPYRIGHTS_ADMIN, $name, $url, $visible, $id);
     pwg_query($query);
   }
@@ -63,8 +87,9 @@
   if ($_GET['tab'] == 'delete') {
     $id = $_REQUEST['id'];
-    $query = '
-      DELETE FROM '.$prefixeTable.'copyrights_admin
-      WHERE `cr_id`='.$id.'
-      ;';
+    $query = sprintf(
+      'DELETE FROM %s
+      WHERE `cr_id`=%d
+      ;',
+      COPYRIGHTS_ADMIN, $id);
     pwg_query($query);
   }
@@ -80,8 +105,9 @@
 );
 
-$query = '
-  SELECT *
-  FROM '.COPYRIGHTS_ADMIN.'
-  ;';
+$query = sprintf(
+  'SELECT *
+  FROM %s
+  ;',
+  COPYTIGHTS_ADMIN);
 $result = pwg_query($query);
 
Index: /extensions/Copyrights/main.inc.php
===================================================================
--- /extensions/Copyrights/main.inc.php	(revision 10930)
+++ /extensions/Copyrights/main.inc.php	(revision 10931)
@@ -8,4 +8,25 @@
 Author URI: http://www.watergallery.nl/piwigo/plugins/copyrights/
 */
+// +-----------------------------------------------------------------------+
+// | Piwigo - a PHP based picture gallery                                  |
+// +-----------------------------------------------------------------------+
+// | Copyright(C) 2008-2009 Piwigo Team                  http://piwigo.org |
+// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
+// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
+// +-----------------------------------------------------------------------+
+// | This program is free software; you can redistribute it and/or modify  |
+// | it under the terms of the GNU General Public License as published by  |
+// | the Free Software Foundation                                          |
+// |                                                                       |
+// | This program is distributed in the hope that it will be useful, but   |
+// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
+// | General Public License for more details.                              |
+// |                                                                       |
+// | You should have received a copy of the GNU General Public License     |
+// | along with this program; if not, write to the Free Software           |
+// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
+// | USA.                                                                  |
+// +-----------------------------------------------------------------------+
 
 if (!defined('PHPWG_ROOT_PATH')) die('Hacking attempt!');
@@ -49,9 +70,10 @@
 
   // Fetch all the copyrights and assign them to the template
-  $query = '
-    SELECT `cr_id`,`name`
-    FROM '.COPYRIGHTS_ADMIN.'
+  $query = sprintf(
+    'SELECT `cr_id`,`name`
+    FROM %s
     WHERE `visible`<>0
-    ;';
+    ;',
+    COPYRIGHT_ADMIN);
   $result = pwg_query($query);
   $CRoptions = array();
@@ -79,12 +101,13 @@
   if ($action == 'copyrights')
   {
-	  $crID = $_POST['copyrightID'];
+	  $crID = pwg_db_real_escape_string($_POST['copyrightID']);
     
     if (count($collection) > 0) {
-      $query = '
-        DELETE
-        FROM '.COPYRIGHTS_MEDIA.'
-        WHERE media_id IN ('.implode(',', $collection).')
-        ;';
+      $query = sprintf(
+        'DELETE
+        FROM %s
+        WHERE media_id IN (%s)
+        ;',
+        COPYRIGHT_MEDIA, implode(',', $collection));
       pwg_query($query);
     }
Index: /extensions/Copyrights/maintain.inc.php
===================================================================
--- /extensions/Copyrights/maintain.inc.php	(revision 10930)
+++ /extensions/Copyrights/maintain.inc.php	(revision 10931)
@@ -1,3 +1,24 @@
 <?php
+// +-----------------------------------------------------------------------+
+// | Piwigo - a PHP based picture gallery                                  |
+// +-----------------------------------------------------------------------+
+// | Copyright(C) 2008-2009 Piwigo Team                  http://piwigo.org |
+// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
+// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
+// +-----------------------------------------------------------------------+
+// | This program is free software; you can redistribute it and/or modify  |
+// | it under the terms of the GNU General Public License as published by  |
+// | the Free Software Foundation                                          |
+// |                                                                       |
+// | This program is distributed in the hope that it will be useful, but   |
+// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
+// | General Public License for more details.                              |
+// |                                                                       |
+// | You should have received a copy of the GNU General Public License     |
+// | along with this program; if not, write to the Free Software           |
+// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
+// | USA.                                                                  |
+// +-----------------------------------------------------------------------+
 
 function plugin_install() {
Index: tensions/Copyrights/manage_copyrights.php
===================================================================
--- /extensions/Copyrights/manage_copyrights.php	(revision 10930)
+++ 	(revision )
@@ -1,37 +1,0 @@
-<?php
-// Not that its usefull - this will be dumped anyway, but ok, i changed soemthing ;-)
-
-if ($_REQUEST['action'] == 'create') {
-  $name = $_REQUEST['name'];
-  $url = $_REQUEST['url'];
-  $visible = ($_REQUEST['visible'] == 'hide' ? 1 : 0);
-  $query = '
-    INSERT INTO '.$prefixeTable.'copyrights_admin
-    (`name`,`url`,`visible`) VALUES
-    ("'.$name.'","'.$url.'",'.$visible.')
-    ;';
-  pwg_query($query);
-}
-
-if ($_REQUEST['action'] == 'edit') {
-  $id = $_REQUEST['id'];
-  $name = $_REQUEST['name'];
-  $url = $_REQUEST['url'];
-  $visible = ($_REQUEST['visible'] == 'show' ? 1 : 0);
-  $query = '
-    UPDATE '.$prefixeTable.'copyrights_admin
-    `name`="'.$name.'", `url`="'.$url.'", `visible`='.$visible.'
-    WHERE `cr_id`='.$id.'
-    ;';
-  pwg_query($query);
-}
-
-if ($_REQUEST['action'] == 'delete') {
-  $id = $_REQUEST['id'];
-  $query = '
-    DELETE FROM '.$prefixeTable.'copyrights_admin
-    WHERE `cr_id`='.$id.'
-    ;';
-  pwg_query($query);
-}
-?>
