cvs: docweb /include lib_revcheck.inc.php
| From: | Nuno Lopes | Date: | Sun, 05 Feb 2006 20:44:50 +0000 |
| Subject: | cvs: docweb /include lib_revcheck.inc.php | ||
| Groups: | php.doc.web | ||
| Request: | Send a blank email to doc-web+get-854@lists.php.net to get a copy of this message | ||
nlopess Sun Feb 5 20:44:50 2006 UTC
Modified files:
/docweb/include lib_revcheck.inc.php
Log:
fix sql injection bug introduced in last commit
http://cvs.php.net/viewcvs.cgi/docweb/include/lib_revcheck.inc.php?r1=1.11&r2=1.12&diff_format=u
Index: docweb/include/lib_revcheck.inc.php
diff -u docweb/include/lib_revcheck.inc.php:1.11 docweb/include/lib_revcheck.inc.php:1.12
--- docweb/include/lib_revcheck.inc.php:1.11 Sun Feb 5 11:17:37 2006
+++ docweb/include/lib_revcheck.inc.php Sun Feb 5 20:44:50 2006
@@ -157,7 +157,7 @@
AND
c.lang="en"
AND
- a.maintainer = "' . $user . '"
+ a.maintainer = \'' . sqlite_escape_string($user) . '\'
AND
a.revision != c.revision order by b.name';
$result = sqlite_query($idx, $sql);