diff options
Diffstat (limited to 'phpBB')
| -rw-r--r-- | phpBB/admin/admin_groups.php | 7 | ||||
| -rw-r--r-- | phpBB/admin/admin_ranks.php | 6 |
2 files changed, 7 insertions, 6 deletions
diff --git a/phpBB/admin/admin_groups.php b/phpBB/admin/admin_groups.php index faad5502f4..9883ae4211 100644 --- a/phpBB/admin/admin_groups.php +++ b/phpBB/admin/admin_groups.php @@ -221,7 +221,8 @@ else if( isset($HTTP_POST_VARS['group_update']) ) if ( $delete_old_moderator != "" ) { $sql = "DELETE FROM " . USER_GROUP_TABLE . " - WHERE user_id = " . $group_info['group_moderator'] . " AND group_id = " . $group_id; + WHERE user_id = " . $group_info['group_moderator'] . " + AND group_id = " . $group_id; if ( !$result = $db->sql_query($sql) ) { message_die(GENERAL_ERROR, "Couldn't update group moderator", "", __LINE__, __FILE__, $sql); @@ -235,7 +236,7 @@ else if( isset($HTTP_POST_VARS['group_update']) ) } } $sql = "UPDATE " . GROUPS_TABLE . " - SET group_type = $group_type, group_name = '" . $group_name . "', group_description = '" . $group_description . "', group_moderator = $group_moderator + SET group_type = $group_type, group_name = '" . str_replace("\'", "''", $group_name) . "', group_description = '" . str_replace("\'", "''", $group_description) . "', group_moderator = $group_moderator WHERE group_id = $group_id"; if ( !$result = $db->sql_query($sql) ) { @@ -259,7 +260,7 @@ else if( isset($HTTP_POST_VARS['group_update']) ) $new_group_id = $row['new_group_id'] + 1; $sql = "INSERT INTO " . GROUPS_TABLE . " (group_id, group_type, group_name, group_description, group_moderator, group_single_user) - VALUES ($new_group_id, '" . $group_type . "', '" . $group_name . "', '" . $group_description . "', '" . $group_moderator . "', '0')"; + VALUES ($new_group_id, $group_type, '" . str_replace("\'", "''", $group_name) . "', '" . str_replace("\'", "''", $group_description) . "', $group_moderator, '0')"; if ( !$result = $db->sql_query($sql) ) { message_die(GENERAL_ERROR, "Couldn't insert new group", "", __LINE__, __FILE__, $sql); diff --git a/phpBB/admin/admin_ranks.php b/phpBB/admin/admin_ranks.php index d7562aa6da..55d3ef6487 100644 --- a/phpBB/admin/admin_ranks.php +++ b/phpBB/admin/admin_ranks.php @@ -164,7 +164,7 @@ if( $mode != "" ) if( $rank_id ) { $sql = "UPDATE " . RANKS_TABLE . " - SET rank_title = '$rank_title', rank_special = $special_rank, rank_max = 0, rank_min = $min_posts, rank_image = '$rank_image' + SET rank_title = '" . str_replace("\'", "''", $rank_title) . "', rank_special = $special_rank, rank_max = 0, rank_min = $min_posts, rank_image = '" . str_replace("\'", "''", $rank_image) . "' WHERE rank_id = $rank_id"; $message = $lang['Rank_updated']; @@ -172,7 +172,7 @@ if( $mode != "" ) else { $sql = "INSERT INTO " . RANKS_TABLE . " (rank_title, rank_special, rank_max, rank_min, rank_image) - VALUES ('$rank_title', $special_rank, 0, $min_posts, '$rank_image')"; + VALUES ('" . str_replace("\'", "''", $rank_title) . "', $special_rank, 0, $min_posts, '" . str_replace("\'", "''", $rank_image) . "')"; $message = $lang['Rank_added']; } @@ -352,4 +352,4 @@ $template->pparse("body"); include('page_footer_admin.'.$phpEx); -?> +?>
\ No newline at end of file |