diff options
| author | cookie <cookie@29ba0400-6e00-0410-a75a-ca02368028f8> | 2006-12-11 07:47:43 +0000 |
|---|---|---|
| committer | cookie <cookie@29ba0400-6e00-0410-a75a-ca02368028f8> | 2006-12-11 07:47:43 +0000 |
| commit | 3f8cf2ca9beb7ef7ccd84912391e3e351be0985b (patch) | |
| tree | 18b9eed3984ef007eb09c96255b14e58172f40f3 /www-ssl/admin/schichtplan.php | |
| parent | 4736d1eb9ee63f0bc3121e078e2c1ed6669f3fda (diff) | |
sql injektion gemeldet by sven
git-svn-id: svn://svn.cccv.de/engel-system@204 29ba0400-6e00-0410-a75a-ca02368028f8
Diffstat (limited to 'www-ssl/admin/schichtplan.php')
| -rwxr-xr-x | www-ssl/admin/schichtplan.php | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/www-ssl/admin/schichtplan.php b/www-ssl/admin/schichtplan.php index 12c767c2..3bf2bb4f 100755 --- a/www-ssl/admin/schichtplan.php +++ b/www-ssl/admin/schichtplan.php @@ -40,7 +40,7 @@ echo "<form action=\"".$_SERVER['SCRIPT_NAME']."\" method=\"GET\" >\n"; <?PHP $sql = "SELECT `SID`, `DateS`, `RID`, `Len` FROM `Shifts` ". - "ORDER BY RID, DateS "; + "ORDER BY `RID`, `DateS` "; $Erg = mysql_query($sql, $con); $rowcount = mysql_num_rows($Erg); for( $i = 0; $i < $rowcount; $i++) @@ -300,7 +300,7 @@ case 'changesave': "`Len`='". $_GET["eDauer"]. "', ". "`Man`='". $_GET["eName"]. "', ". "`URL`='". $_GET["eURL"]. "' ". - "WHERE `SID`=". $_GET["SID"]; + "WHERE `SID`='". $_GET["SID"]. "'"; SetHeaderGo2Back(); break; @@ -315,10 +315,10 @@ case 'deleteShifs': if( strpos( " ".$k, "SID") == 1) { echo "Shifts $v wird gelöscht..."; - executeSQL( "DELETE FROM `Shifts` WHERE `SID`=$v LIMIT 1"); + executeSQL( "DELETE FROM `Shifts` WHERE `SID`='$v' LIMIT 1"); echo "<br>\n"; echo "ShiftEntry $v wird gelöscht..."; - executeSQL( "DELETE FROM `ShiftEntry` WHERE `SID`= $v"); + executeSQL( "DELETE FROM `ShiftEntry` WHERE `SID`='$v'"); echo "<br><br>\n"; } break; |