Author: pwang
Date: 2013-02-07 15:48:54 -0800 (Thu, 07 Feb 2013)
New Revision: 31112
Modified:
new_cytoscape_website/bugreport/bugreport.php
Log:
Use mysql_real_escape_string()
Modified: new_cytoscape_website/bugreport/bugreport.php
===================================================================
--- new_cytoscape_website/bugreport/bugreport.php 2013-02-07 23:37:25 UTC
(rev 31111)
+++ new_cytoscape_website/bugreport/bugreport.php 2013-02-07 23:48:54 UTC
(rev 31112)
@@ -226,7 +226,7 @@
// Load attached files first
if ($bugReport['attachedFiles'] != NULL &&
$bugReport['attachedFiles']['name'] != NULL){
- $name = $bugReport['attachedFiles']['name'];
+ $name =
mysql_real_escape_string($bugReport['attachedFiles']['name']);
$type = $bugReport['attachedFiles']['type'];
$md5 = $bugReport['attachedFiles']['md5'];
$content = $bugReport['attachedFiles']['fileContent'];
@@ -243,7 +243,7 @@
// Step 2: get the reporter id
$reporter_auto_id = null;
// Check if the reporter already existed in table 'reporter'
- $dbQuery = "SELECT reporter_auto_id FROM reporter WHERE email ='"
.$bugReport['email']."'";
+ $dbQuery = "SELECT reporter_auto_id FROM reporter WHERE email ='"
.mysql_real_escape_string($bugReport['email'])."'";
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
showerror();
@@ -257,7 +257,7 @@
// the reporter is new, add it to DB
if ($reporter_auto_id == null){
// Insert a row into table reporter
- $dbQuery = "INSERT INTO reporter (name, email) Values
('".$bugReport['name']."','".$bugReport['email']."')";
+ $dbQuery = "INSERT INTO reporter (name, email) Values
('".mysql_real_escape_string($bugReport['name'])."','".mysql_real_escape_string($bugReport['email'])."')";
// Run the query
if (!(@ mysql_query($dbQuery, $connection)))
showerror();
@@ -267,10 +267,10 @@
// Step 3: add a report to table "bugs"
$bug_auto_id = null;
- $cyversion = $bugReport['cyversion'];
- $os = $bugReport['os'];
- $subject = $bugReport['subject'];
- $description = $bugReport['description'];
+ $cyversion = mysql_real_escape_string($bugReport['cyversion']);
+ $os = mysql_real_escape_string($bugReport['os']);
+ $subject = mysql_real_escape_string($bugReport['subject']);
+ $description = mysql_real_escape_string($bugReport['description']);
$ip_address = $bugReport['ip_address'];
$remote_host = $bugReport['remote_host'];
--
You received this message because you are subscribed to the Google Groups
"cytoscape-cvs" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/cytoscape-cvs?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
