diff options
| author | Philip Häusler <msquare@notrademark.de> | 2014-12-28 13:44:56 +0100 |
|---|---|---|
| committer | Philip Häusler <msquare@notrademark.de> | 2014-12-28 13:44:56 +0100 |
| commit | 6bede2fd229395f34c321a37efa2ea93e7b1a7ba (patch) | |
| tree | a20c74d5bdddae9e1ec9a988e1ba468371a4a995 /includes/pages/admin_news.php | |
| parent | a6ab81b834fe91b0f0704a7db33e377c8dc63a23 (diff) | |
harden the sql queries
Diffstat (limited to 'includes/pages/admin_news.php')
| -rw-r--r-- | includes/pages/admin_news.php | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/includes/pages/admin_news.php b/includes/pages/admin_news.php index a4474ff9..1c435a14 100644 --- a/includes/pages/admin_news.php +++ b/includes/pages/admin_news.php @@ -11,7 +11,7 @@ function admin_news() { else return error("Incomplete call, missing News ID.", true); - $news = sql_select("SELECT * FROM `News` WHERE `ID`=" . sql_escape($id) . " LIMIT 1"); + $news = sql_select("SELECT * FROM `News` WHERE `ID`='" . sql_escape($id) . "' LIMIT 1"); if (count($news) > 0) { switch ($_REQUEST["action"]) { default: @@ -44,7 +44,7 @@ function admin_news() { `Text`='" . sql_escape($_POST["eText"]) . "', `UID`='" . sql_escape($user['UID']) . "', `Treffen`='" . sql_escape($_POST["eTreffen"]) . "' - WHERE `ID`=" . sql_escape($id)); + WHERE `ID`='" . sql_escape($id) . "'"); engelsystem_log("News updated: " . $_POST["eBetreff"]); success(_("News entry updated.")); redirect(page_link_to("news")); @@ -53,7 +53,7 @@ function admin_news() { case 'delete': list($news) = $news; - sql_query("DELETE FROM `News` WHERE `ID`=" . sql_escape($id) . " LIMIT 1"); + sql_query("DELETE FROM `News` WHERE `ID`='" . sql_escape($id) . "' LIMIT 1"); engelsystem_log("News deleted: " . $news['Betreff']); success(_("News entry deleted.")); redirect(page_link_to("news")); |