SQL injektion behoben

git-svn-id: svn://svn.cccv.de/engel-system@198 29ba0400-6e00-0410-a75a-ca02368028f8

1 files changed, 2 insertions, 2 deletions

diff --git a/www-ssl/nonpublic/index.php b/www-ssl/nonpublic/index.php
index 20b32c00..ba47e4d9 100755
--- a/www-ssl/nonpublic/index.php
+++ b/www-ssl/nonpublic/index.php
@@ -20,7 +20,7 @@ if ( !IsSet($_POST["user"]))
 } 
 else
 { // User ist noch nicht angemeldet 
-	$sql = "select * from User where Nick = '". $_POST["user"]. "'";
+	$sql = "SELECT * FROM `User` WHERE `Nick`='". $_POST["user"]. "'";
 	$userstring = mysql_query($sql, $con);
 
 	// anzahl zeilen
@@ -54,7 +54,7 @@ else
 			$_SESSION['IP'] = $_SERVER['REMOTE_ADDR'];
 		
 			// CVS import Data
-			$SQL = "SELECT * FROM `UserCVS` WHERE UID='".$_SESSION['UID']."'";
+			$SQL = "SELECT * FROM `UserCVS` WHERE `UID`='".$_SESSION['UID']."'";
 			$Erg_CVS =  mysql_query($SQL, $con);
 			$_SESSION['CVS'] = mysql_fetch_array($Erg_CVS);