iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-03-28 17:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug 471 fixed: quote in tags

Browse Source 
svn merge from trunk into branch-1.6


git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1488 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
nikrou
2006-07-21 13:47:50 +00:00
parent 19fa4408c8
commit fdc7bdbd3b
2 changed files with 39 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
admin/tags.php
View File

@@ -149,20 +149,13 @@ DELETE
if (isset($_POST['add']) and !empty($_POST['add_tag']))
{
if (function_exists('mysql_real_escape_string'))
{
$tag_name = mysql_real_escape_string($_POST['add_tag']);
}
else
{
$tag_name = mysql_escape_string($_POST['add_tag']);
}
$tag_name = $_POST['add_tag'];
// does the tag already exists?
$query = '
SELECT id
FROM '.TAGS_TABLE.'
WHERE name = \''.$tag_name.'\'
WHERE name = \''.pwg_quotemeta($tag_name).'\'
;';
$existing_tags = array_from_query($query, 'id');
@@ -173,7 +166,7 @@ SELECT id
array('name', 'url_name'),
array(
array(
'name' => $tag_name,
'name' => pwg_quotemeta($tag_name),
'url_name' => str2url($tag_name),
)
)
@@ -183,7 +176,7 @@ SELECT id
$page['infos'],
sprintf(
l10n('Tag "%s" was added'),
$tag_name
pwg_stripslashes($tag_name)
)
);
}
@@ -193,7 +186,7 @@ SELECT id
$page['errors'],
sprintf(
l10n('Tag "%s" already exists'),
$tag_name
pwg_stripslashes($tag_name)
)
);
}

34
include/functions.inc.php
View File

@@ -460,6 +460,40 @@ function format_date($date, $type = 'us', $show_time = false)
return $formated_date;
}
function pwg_stripslashes($value)
{
if (get_magic_quotes_gpc())
{
$value = stripslashes($value);
}
return $value;
}
function pwg_addslashes($value)
{
if (!get_magic_quotes_gpc())
{
$value = addslashes($value);
}
return $value;
}
function pwg_quotemeta($value)
{
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if (function_exists('mysql_real_escape_string'))
{
$value = mysql_real_escape_string($value);
}
else
{
$value = mysql_escape_string($value);
}
return $value;
}
function pwg_query($query)
{
global $conf,$page,$debug,$t2;