Changeset 586 for trunk/includes/global.php

Timestamp:

Oct 7, 2013, 11:52:11 PM (11 years ago)

Author:

chronos

Message:

• Fixed: SQL injection protection was not applied because of new dynamic URL handling.
• Fixed: HTML entities encodin for search input string.

File:

• trunk/includes/global.php (modified) (1 diff)

trunk/includes/global.php

@@ -633 +633 @@
         else $_SERVER['QUERY_STRING'] = '';
         parse_str($_SERVER['QUERY_STRING'], $_GET);
+  // SQL injection hack protection
+  foreach($_GET as $Index => $Item) $_GET[$Index] = addslashes($_GET[$Index]);
         return($PathItems);
 }