Project

General

Profile

« Previous | Next » 

Revision 656

Added by thorn almost 17 years ago

Added some missing add_slashes(), get_post_escaped(), and strip_tags() for $_POST, $_GET and $_REQUEST-data. Also for $_SERVER['PHP_SELF'].

View differences:

tool.php
52 52 
	");
53 53 

  		




  54
  54
  
    
	// save text-captchas


  		




  55
  
  
    
	if($_POST['captcha_type'] == 'text') { // ct_text


  		




  56
  
  
    
		$text_qa=$_POST['text_qa'];


  		




  
  55
  
    
	if($captcha_type == 'text') { // ct_text


  		




  
  56
  
    
		$text_qa=$admin->add_slashes($_POST['text_qa']);


  		




  57
  57
  
    
		if(strpos($text_qa, '### example ###') === FALSE) {


  		




  58
  
  
    
			$text_qa=$admin->add_slashes($text_qa);


  		




  59
  58
  
    
			$database->query("UPDATE $table SET ct_text = '$text_qa'");


  		




  60
  59
  
    
		}


  		




  61
  60
  
    
	}


  		




  ......




  76
  75
  
    
	$text_qa='';


  		




  77
  76
  
    
	if($query = $database->query("SELECT ct_text FROM $table")) {


  		




  78
  77
  
    
		$data = $query->fetchRow();


  		




  79
  
  
    
		$text_qa = $admin->strip_slashes($data['ct_text']);


  		




  
  78
  
    
		$text_qa = $data['ct_text'];


  		




  80
  79
  
    
	}


  		




  81
  80
  
    
	if($text_qa == '')


  		




  82
  81
  
    
		$text_qa = $MOD_CAPTCHA_CONTROL['CAPTCHA_TEXT_DESC'];


  		




  ......




  125
  124
  
    
		$data = $query->fetchRow();


  		




  126
  125
  
    
		$enabled_captcha = $data['enabled_captcha'];


  		




  127
  126
  
    
		$enabled_asp = $data['enabled_asp'];


  		




  128
  
  
    
		$captcha_type = $admin->strip_slashes($data['captcha_type']);


  		




  
  127
  
    
		$captcha_type = $data['captcha_type'];


  		




  129
  128
  
    
	} else {


  		




  130
  129
  
    
		// something went wrong, use dummy value


  		




  131
  130
  
    
		$enabled_captcha = '1';


  		












Also available in:  Unified diff