|
@@ -234,6 +234,7 @@ class MessageManager
|
|
$subject = Database::escape_string($subject);
|
|
$subject = Database::escape_string($subject);
|
|
$content = api_convert_encoding($content,$charset);
|
|
$content = api_convert_encoding($content,$charset);
|
|
$content = Database::escape_string($content);
|
|
$content = Database::escape_string($content);
|
|
|
|
+ $content = Security::remove_XSS($content);
|
|
|
|
|
|
//useless query
|
|
//useless query
|
|
//echo $sql = "SELECT COUNT(*) as count FROM $table_message WHERE user_sender_id = ".$user_sender_id." AND user_receiver_id='$receiver_user_id' AND title = '$title' AND content ='$content' AND group_id = '$group_id' AND parent_id = '$parent_id'";
|
|
//echo $sql = "SELECT COUNT(*) as count FROM $table_message WHERE user_sender_id = ".$user_sender_id." AND user_receiver_id='$receiver_user_id' AND title = '$title' AND content ='$content' AND group_id = '$group_id' AND parent_id = '$parent_id'";
|