Menu

#19 Error in creating/modifying document

open
nobody
None
5
2005-01-28
2005-01-28
No

When creating a new document and/or updating an
existing one, you get an SQL error if the document
contains quotes, double quotes or any character
recognized by SQL as a special one.
I solved the bug changing the following lines in file
script_modify_document.php:

$in_data_title = $_POST["mod_title"];
$in_data_summary = $_POST["mod_summary"];
$in_data_body = $_POST["docpost"];

to the following:

$in_data_title = $_POST["mod_title"];
$in_data_title = addslashes($in_data_title);
$in_data_title = addcslashes($in_data_title, "\0..\37");
$in_data_summary = $_POST["mod_summary"];
$in_data_summary = addslashes($in_data_summary);
$in_data_summary = addcslashes($in_data_summary,
"\0..\37");
$in_data_body = $_POST["docpost"];
$in_data_body = addslashes($in_data_body);
$in_data_body = addcslashes($in_data_body, "\0..\37");

Discussion


Log in to post a comment.