From 8500be3f1ba7bcab6b8523507e74a132df58d925 Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Thu, 18 Sep 2008 06:25:41 -0400
Subject: [PATCH] - Changed addslashes to mysql_real_escape_string in several files. - Updated Debian installation instructions.
---
interface/lib/classes/db_mysql.inc.php | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/interface/lib/classes/db_mysql.inc.php b/interface/lib/classes/db_mysql.inc.php
index eaa57b0..ca3b38c 100644
--- a/interface/lib/classes/db_mysql.inc.php
+++ b/interface/lib/classes/db_mysql.inc.php
@@ -160,10 +160,14 @@
return $this->quote($formfield);
}
- /** Escapes quotes in variable. addslashes() */
+ /** Escapes quotes in variable. mysql_real_escape_string() */
public function quote($formfield)
- {
- return addslashes($formfield);
+ {
+ if(!$this->connect()){
+ $this->updateError('WARNING: mysql_connect: Used addslashes instead of mysql_real_escape_string');
+ return addslashes($formfield);
+ }
+ return mysql_real_escape_string($formfield, $this->linkId);
}
/** Unquotes a variable, strip_slashes() */
--
Gitblit v1.9.1