Changeset 251 for quests/save.php

Timestamp:

Jan 20, 2008, 8:44:37 PM (17 years ago)

Author:

maron

Message:

NPC_text

File:

• quests/save.php (modified) (3 diffs)

quests/save.php

@@ -2 +2 @@
 
   include('includes/global.php');
+
+  // SQL injection hack protection
+  foreach($_POST as $Index => $Item) $_POST[$Index] = addslashes($Item);
+  foreach($_GET as $Index => $Item) $_GET[$Index] = addslashes($Item);
 
   if (array_key_exists('entry', $_POST)) {
@@ -39 +43 @@
     if (!$Line) {
     
-      $Database->SQLCommand("INSERT INTO `quests` (`entry` , `Title` , `Details` , `Objectives` , `OfferRewardText` , `RequestItemsText` , `EndText` , `ObjectiveText1` , `ObjectiveText2` , `ObjectiveText3` , `ObjectiveText4` , `Language` , `User` , `complete` , `Take` )
-      VALUES('$entry','$Title','$Details','$Objectives','$OfferRewardText','$RequestItemsText','$EndText','$ObjectiveText1','$ObjectiveText2','$ObjectiveText3','$ObjectiveText4','$Language','$UserID','$complete','$QuestID')");
+      $Database->SQLCommand("INSERT INTO `quests` (`entry` , `Title` , `Details` , `Objectives` , `OfferRewardText` , `RequestItemsText` ,
+      `EndText` , `ObjectiveText1` , `ObjectiveText2` , `ObjectiveText3` , `ObjectiveText4` , `Language` , `User` , `complete` , `Take` , `Vote` , `CountVote` )
+      VALUES('$entry','$Title','$Details','$Objectives','$OfferRewardText','$RequestItemsText','$EndText','$ObjectiveText1',
+      '$ObjectiveText2','$ObjectiveText3','$ObjectiveText4','$Language','$UserID','$complete','$QuestID','3','1')");
       echo 'Quest: '.$entry.' ulo¾en!<br />';
-      WriteLog('Quest: '.$entry.' ulo¾en! <a href="form.php?ID='.$QuestID.'">'.$QuestID.'</a>', 1);
+      WriteLog('Quest: '.$entry.' uloµen! <a href="form.php?ID='.$QuestID.'">'.$QuestID.'</a>', 1);
     } else {
       $sql = "UPDATE quests SET complete = '$complete', Title = '$Title',
@@ -54 +60 @@
     //  echo $sql.'<br />';      
       echo 'Zmìny v Questu: '.$entry.' ulo¾eny!<br />';
-      WriteLog('Zmìny v Questu: '.$entry.' ulo¾eny! <a href="form.php?ID='.$QuestID.'">'.$QuestID.'</a>', 1);
+      WriteLog('Zmìny v Questu: '.$entry.' uloµeny! <a href="form.php?ID='.$QuestID.'">'.$QuestID.'</a>', 1);
       $Database->SQLCommand("DELETE FROM `quests_vote` WHERE `quests_vote`.`IDquest` = ".$QuestID);
     }
     
-    echo 'Pøekládat: <a href="ListQuests.php?selection">Nepøeloµené</a> ';
+    echo 'Pøekládat: <a href="ListQuests.php?selection">Nepøeloœené</a> ';
       
   }