Not signed in (Sign In)

Vanilla 1.1.10 is a product of Lussumo. More Information: Documentation, Community Support.

General Support: missing addslashes in mysql statement

Bottom of Page

1 to 2 of 2

  1.  
    • CommentAuthorfranto
    • CommentTimeJul 16th 2006
     
    Hi,

    i found 1 bug and it seems to be still not repaired in svn, so i'm posting it here couse i din't realized how to post it to dev.plogger.org.

    file: plog-admin-functions.php;
    function: update_album();

    at the bottom of the function, where is updating the path for all pictures:

    while($row = mysql_fetch_assoc($result)) {

    $filename = basename($row['path']);
    $new_path = $source_collection_name."/".$target_name."/".$filename;

    // update database
    $sql = "UPDATE ".$TABLE_PREFIX."pictures SET path = '$new_path' WHERE id = '$row[id]'";

    }

    the variable $new_path can contain slashes, so it have to be escaped via 'SmartAddSlashes' function.

    Franto
    • CommentAuthormiri
    • CommentTimeAug 5th 2006
     
    A strip slashes appears to be missing on the edit caption function too. I was getting multiple escapes as I edited a caption I was able to change that by going into admin/plog_manage.php and changing line 326 to:

    $output .= 'Caption:<br/><input size="80" name="caption" id="caption" value="'.stripslashes($photo['caption']).'">

1 to 2 of 2

  1.