Changeset 4304 for trunk/include/functions_comment.inc.php

Timestamp:

Nov 18, 2009, 9:07:20 PM (14 years ago)

Author:

Eric

Message:

Escape all login and username characters in database
Display correctly usernames

(I hope not to have made mistakes)

File:

• trunk/include/functions_comment.inc.php (modified) (1 diff)

trunk/include/functions_comment.inc.php

@@ -100 +100 @@
 SELECT COUNT(*) AS user_exists
   FROM '.USERS_TABLE.'
-  WHERE '.$conf['user_fields']['username']." = '".$comm['author']."'";
+  WHERE '.$conf['user_fields']['username']." = '".addslashes($comm['author'])."'";
       $row = mysql_fetch_assoc( pwg_query( $query ) );
       if ( $row['user_exists'] == 1 )