From e8bef0cf23d1a1549de17f9c9598333bf78bd29f Mon Sep 17 00:00:00 2001 From: plegall Date: Mon, 12 Sep 2022 14:37:26 +0200 Subject: [PATCH] fixes #250 escape chars before insert in database * usefull when you configure your Piwigo to allow special chars like single quotes * will work for single quote, but not for & --- admin/site_update.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/admin/site_update.php b/admin/site_update.php index fa278ba21..8b4e3a893 100644 --- a/admin/site_update.php +++ b/admin/site_update.php @@ -529,10 +529,10 @@ SELECT id, path $insert = array( 'id' => $next_element_id++, - 'file' => $filename, - 'name' => get_name_from_file($filename), + 'file' => pwg_db_real_escape_string($filename), + 'name' => pwg_db_real_escape_string(get_name_from_file($filename)), 'date_available' => CURRENT_DATE, - 'path' => $path, + 'path' => pwg_db_real_escape_string($path), 'representative_ext' => $fs[$path]['representative_ext'], 'storage_category_id' => $db_fulldirs[$dirname], 'added_by' => $user['id'],