Changeset 6703 for extensions/lmt/lmt_aip.class.inc.php

Timestamp:

Jul 24, 2010, 6:06:10 PM (14 years ago)

Author:

grum

Message:

Version 1.2.3, bug:1699

File:

• extensions/lmt/lmt_aip.class.inc.php (modified) (2 diffs)

extensions/lmt/lmt_aip.class.inc.php

@@ -564 +564 @@
       if($_POST["text1"]!="")
       {
-        $sql="INSERT INTO ".$this->tables["licence_author"]." VALUES('', '". addslashes($_POST["text1"])."', '".addslashes($_POST["text2"])."')";
+        $sql="INSERT INTO ".$this->tables["licence_author"]." VALUES('', '". htmlspecialchars($_POST["text1"], ENT_QUOTES)."', '".htmlspecialchars($_POST["text2"], ENT_QUOTES)."')";
         $result=pwg_query($sql);
         if($result)
@@ -590 +590 @@
       {
         $sql="UPDATE ".$this->tables["licence_author"]."
-              SET text1 = '". addslashes($_POST["text1"])."',
-                  text2 = '".addslashes($_POST["text2"])."'
+              SET text1 = '". htmlspecialchars($_POST["text1"], ENT_QUOTES)."',
+                  text2 = '".htmlspecialchars($_POST["text2"], ENT_QUOTES)."'
               WHERE id = '".$_POST["id"]."'";
         $result=pwg_query($sql);