- Changed addslashes to mysql_real_escape_string in several files. - Update...

tbrehm

2008-09-18 8500be3f1ba7bcab6b8523507e74a132df58d925

 interface/web/mail/mail_get_edit.php

@@ -92,7 +92,7 @@
      } // end if user is not admin
      
      // Set the server ID according to the selected destination
      $tmp = $app->db->queryOneRecord("SELECT server_id FROM mail_user WHERE email = '".addslashes($this->dataRecord["destination"])."'");
      $tmp = $app->db->queryOneRecord("SELECT server_id FROM mail_user WHERE email = '".mysql_real_escape_string($this->dataRecord["destination"])."'");
      $this->dataRecord["server_id"] = $tmp["server_id"];
      unset($tmp);