chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

[svn r11117] casting $blog_id, $_user['id'], $task_id, ... and alike

Browse Source 
and using mysql_real_escape_string
to fix XSS and SQL injections
http://www.dokeos.com/forum/viewtopic.php?t=8464
skala
Patrick Cool 18 years ago
parent a69d1e80f3
commit f00eeddbf2
1 changed files with 14 additions and 14 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 8
      main/blog/blog_admin.php

8
main/blog/blog_admin.php
Unescape View File

@ -61,15 +61,15 @@ if ($_POST['new_blog_submit'])
} }
if ($_POST['edit_blog_submit']) if ($_POST['edit_blog_submit'])
{ {
Blog::edit_blog(mysql_real_escape_string($_POST['blog_id']),mysql_real_escape_string($_POST['blog_name']),mysql_real_escape_string($_POST['blog_subtitle'])); Blog::edit_blog(mysql_real_escape_string((int)$_POST['blog_id']),mysql_real_escape_string($_POST['blog_name']),mysql_real_escape_string($_POST['blog_subtitle']));
} }
if ($_GET['action'] == 'visibility') if ($_GET['action'] == 'visibility')
{ {
Blog::change_blog_visibility(mysql_real_escape_string($_GET['blog_id'])); Blog::change_blog_visibility(mysql_real_escape_string((int)$_GET['blog_id']));
} }
if ($_GET['action'] == 'delete') if ($_GET['action'] == 'delete')
{ {
Blog::delete_blog(mysql_real_escape_string($_GET['blog_id'])); Blog::delete_blog(mysql_real_escape_string((int)$_GET['blog_id']));
} }
@ -88,7 +88,7 @@ api_display_tool_title($nameTools);
} }
if ($_GET['action'] == 'edit') if ($_GET['action'] == 'edit')
{ {
Blog::display_edit_blog_form(mysql_real_escape_string($_GET['blog_id'])); Blog::display_edit_blog_form(mysql_real_escape_string((int)$_GET['blog_id']));
} }
echo "<a href='".$_SERVER['PHP_SELF']."?action=add'>", echo "<a href='".$_SERVER['PHP_SELF']."?action=add'>",

Write Preview
Loading…
Cancel
Save