valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

disallow ; in labels

This commit is contained in:
Andrew Dolgov 2008-05-17 04:03:03 +01:00
parent a3f4e4d346
commit caf1f12f04
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
modules/pref-labels.php
View File

@ -87,6 +87,8 @@
$expr = trim($_GET["expr"]);
$descr = db_escape_string(trim($_GET["descr"]));
$expr = str_replace(";", "", $expr);
if (!$expr) {
print "<div>Error: SQL expression is blank.</div>";
return;
@ -159,7 +161,9 @@
$sql_exp = db_escape_string(trim($_GET["sql_exp"]));
$descr = db_escape_string(trim($_GET["description"]));
$label_id = db_escape_string($_GET["id"]);
$sql_exp = str_replace(";", "", $sql_exp);
$result = db_query($link, "UPDATE ttrss_labels SET
sql_exp = '$sql_exp',
description = '$descr'
@ -189,6 +193,8 @@
$sql_exp = db_escape_string(trim($_GET["sql_exp"]));
$description = db_escape_string($_GET["description"]);
$sql_exp = str_replace(";", "", $sql_exp);
if (!$sql_exp || !$description) return;
$result = db_query($link,