cvs: phpweb /manual add-note.php
| From: | Jim Winstead | Date: | Mon, 26 Feb 2001 23:02:19 +0000 |
| Subject: | cvs: phpweb /manual add-note.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-4051@lists.php.net to get a copy of this message | ||
jimw Mon Feb 26 15:02:19 2001 EDT
Modified files:
/phpweb/manual add-note.php
Log:
the output side handles all the html encoding, so we don't have to do any here
Index: phpweb/manual/add-note.php
diff -u phpweb/manual/add-note.php:1.14 phpweb/manual/add-note.php:1.15
--- phpweb/manual/add-note.php:1.14 Mon Feb 26 14:58:16 2001
+++ phpweb/manual/add-note.php Mon Feb 26 15:02:19 2001
@@ -46,10 +46,8 @@
if (isset($note)):
$now = date("Y-m-d H:i:s");
$query = "INSERT INTO note (user, note, sect, ts, lang) VALUES ";
- # protect all HTML-like stuff in email (for "Joe Blow <joe@blow.com>")
- $query .= "('" . htmlspecialchars($user) . "',";
- # we don't encode the rest because the output side handles things
- $query .=
"'$note','$sect','$now','$lang')";
+ # no need to call htmlspecialchars() -- we handle it on output
+ $query .=
"('$user','$note','$sect','$now','$lang')";
//echo "<!--$query-->\n";
if (mysql_query($query)):?>
<P>Your submission was successful -- thanks for contributing!