Browse Source

[svn r10646] Added string escaping

Yannick Warnier 18 years ago
parent
commit
21258cf2c4
1 changed files with 4 additions and 0 deletions
  1. 4 0
      main/inc/lib/system_announcements.lib.php

+ 4 - 0
main/inc/lib/system_announcements.lib.php

@@ -320,6 +320,8 @@ class SystemAnnouncementManager
 		}
 		$start = $date_start[0]."-".$date_start[1]."-".$date_start[2]." ".$date_start[3].":".$date_start[4].":".$date_start[5];
 		$end = $date_end[0]."-".$date_end[1]."-".$date_end[2]." ".$date_end[3].":".$date_end[4].":".$date_start[5];
+		$title = mysql_real_escape_string($title);
+		$content = mysql_real_escape_string($content);
 		$sql = "INSERT INTO ".$db_table." (`title`,`content`,`date_start`,`date_end`,`visible_teacher`,`visible_student`,`visible_guest`, `lang`) 
 												VALUES ('".$title."','".$content."','".$start."','".$end."','".$visible_teacher."','".$visible_student."','".$visible_guest."','".$lang."')";
 		
@@ -364,6 +366,8 @@ if (!checkdate($date_start[1], $date_start[2], $date_start[0]))
 		}
 		$start = $date_start[0]."-".$date_start[1]."-".$date_start[2]." ".$date_start[3].":".$date_start[4].":".$date_start[5];
 		$end = $date_end[0]."-".$date_end[1]."-".$date_end[2]." ".$date_end[3].":".$date_end[4].":".$date_start[5];
+		$title = mysql_real_escape_string($title);
+		$content = mysql_real_escape_string($content);
 		$sql = "UPDATE ".$db_table." SET lang='$lang',title='".$title."',content='".$content."',date_start='".$start."',date_end='".$end."', ";
 		$sql .= " visible_teacher = '".$visible_teacher."', visible_student = '".$visible_student."', visible_guest = '".$visible_guest."' WHERE id='".$id."'";
 		return api_sql_query($sql,__FILE__,__LINE__);