SQL injektion behoben

git-svn-id: svn://svn.cccv.de/engel-system@198 29ba0400-6e00-0410-a75a-ca02368028f8

9 files changed, 36 insertions, 37 deletions

diff --git a/www-ssl/nonpublic/einstellungen.php b/www-ssl/nonpublic/einstellungen.php
index faf72be5..eaec09fb 100755
--- a/www-ssl/nonpublic/einstellungen.php
+++ b/www-ssl/nonpublic/einstellungen.php
@@ -140,13 +140,13 @@ switch ($_POST["action"]) {
 case 'set':
   if ($_POST["new1"]==$_POST["new2"]){
 	Print_Text(25); 
-	$sql = "select * from User where UID=".$_SESSION['UID'];
+	$sql = "SELECT * FROM `User` WHERE `UID`='".$_SESSION['UID']. "'";
 	$Erg = mysql_query($sql, $con);
 	if (PassCrypt($_POST["old"])==mysql_result($Erg, 0, "Passwort")) {
 		Print_Text(26);
 		Print_Text(27);
-		$usql = "update User set Passwort='".PassCrypt($_POST["new1"])."' ".
-			"where UID=".$_SESSION['UID']." limit 1";
+		$usql = "UPDATE `User` SET `Passwort`='". PassCrypt($_POST["new1"]). "' ".
+                " WHERE `UID`='". $_SESSION['UID']. "' LIMIT 1";
 		$Erg = mysql_query($usql, $con);
 		if ($Erg==1) {
 			Print_Text(28);
@@ -163,10 +163,10 @@ case 'set':
 
 case 'colour':
 
-	$chsql="Update User set ".
-		"`color` = \"". $_POST["colourid"]. "\", ".
-		"`Menu`= \"". $_POST["eMenu"]. "\" ".
-		"where UID = \"".$_SESSION['UID']."\" limit 1";
+	$chsql="UPDATE `User` SET ".
+		"`color`= '". $_POST["colourid"]. "', ".
+		"`Menu`= '". $_POST["eMenu"]. "' ".
+		"WHERE `UID`='". $_SESSION['UID']. "' LIMIT 1";
 	$Erg = mysql_query($chsql, $con);
 	echo mysql_error($con);
 	$_SESSION['color']=$_POST["colourid"];
@@ -180,7 +180,7 @@ case 'colour':
 
 case 'sprache':
 
-	$chsql="Update User set Sprache = \"". $_POST["language"]. "\" where UID = \"".$_SESSION['UID']."\" limit 1";
+	$chsql="UPDATE `User` SET `Sprache` = '". $_POST["language"]. "' WHERE `UID`='". $_SESSION['UID']. "' LIMIT 1";
 	$Erg = mysql_query($chsql, $con);
 	$_SESSION['Sprache']=$_POST["language"];
 	if ($Erg==1) {
@@ -191,7 +191,7 @@ case 'sprache':
 	break;
 
 case 'avatar':
-	$chsql="Update User set Avatar = \"". $_POST["eAvatar"]. "\" where UID = \"". $_SESSION['UID']. "\" limit 1";
+	$chsql="UPDATE `User` SET `Avatar`='". $_POST["eAvatar"]. "' WHERE `UID`='". $_SESSION['UID']. "' LIMIT 1";
         $Erg = mysql_query($chsql, $con);
 	$_SESSION['Avatar']=$_POST["eAvatar"];
 	if ($Erg==1) {
@@ -202,14 +202,14 @@ case 'avatar':
         break;
 
 case 'setUserData':
-	$chsql= "UPDATE User SET ".
+	$chsql= "UPDATE `User` SET ".
 		"`Nick`='".     $_POST["eNick"].	"', `Name`='".   $_POST["eName"].  "', ".
 		"`Vorname`='".  $_POST["eVorname"].	"', `Alter`='".  $_POST["eAlter"]. "', ".
 		"`Telefon`='".  $_POST["eTelefon"].	"', `Handy`='".  $_POST["eHandy"]. "', ".
 		"`DECT`='".     $_POST["eDECT"]. 	"', `email`='".  $_POST["eemail"]. "', ".
 		"`ICQ`='".      $_POST["eICQ"].		"', `jabber`='". $_POST["ejabber"]."', ".
 		"`Hometown`='". $_POST["Hometown"].	"' ".
-		"WHERE UID='". $_SESSION['UID']. "' LIMIT 1;";
+		"WHERE `UID`='". $_SESSION['UID']. "' LIMIT 1;";
         $Erg = mysql_query($chsql, $con);
 
 	if ($Erg==1) 
diff --git a/www-ssl/nonpublic/faq.php b/www-ssl/nonpublic/faq.php
index fb7dab8c..b7d01835 100755
--- a/www-ssl/nonpublic/faq.php
+++ b/www-ssl/nonpublic/faq.php
@@ -23,7 +23,7 @@ if (!IsSet($_POST["eUID"]))
 
 echo "<b>".Get_Text(37)."</b><br><br>\n".nl2br($_POST["frage"])."<br><br>\n".Get_Text(38)."<br>\n";
 
-$SQL = "INSERT into Questions VALUES (\"\", \"".$_SESSION['UID']."\", \"". $_POST["frage"]. "\", \"\", \"\")";
+$SQL = "INSERT INTO `Questions` VALUES ('', '".$_SESSION['UID']."', '". $_POST["frage"]. "', '', '')";
 $Erg = mysql_query($SQL, $con);
 
 }
@@ -32,7 +32,7 @@ echo "<br>\n<b>".Get_Text(39)."</b><br>\n";
 echo "<hr width=\"99%\">\n";
 echo "<br><b>".Get_Text(40)."</b><br>\n";
 
-$SQL = "SELECT * from Questions where UID = ".$_SESSION['UID']." and AID=\"0\" ORDER BY 'QID' DESC";
+$SQL = "SELECT * FROM `Questions` WHERE `UID` = ". $_SESSION['UID']. " AND `AID`='0' ORDER BY 'QID' DESC";
 $Erg = mysql_query($SQL, $con);
 
 // anzahl zeilen
@@ -52,7 +52,7 @@ if ($Zeilen==0){
 
 echo "<hr width=\"99%\">\n";
 echo "<br><b>".Get_Text(42)."</b><br>\n";
-$SQL = "SELECT * from Questions where UID = ".$_SESSION['UID']." and AID<>\"0\" ORDER BY 'QID' DESC";
+$SQL = "SELECT * FROM `Questions` WHERE `UID`='".$_SESSION['UID']."' and `AID`<>'0' ORDER BY 'QID' DESC";
 $Erg = mysql_query($SQL, $con);
 
 // anzahl zeilen
diff --git a/www-ssl/nonpublic/index.php b/www-ssl/nonpublic/index.php
index 20b32c00..ba47e4d9 100755
--- a/www-ssl/nonpublic/index.php
+++ b/www-ssl/nonpublic/index.php
@@ -20,7 +20,7 @@ if ( !IsSet($_POST["user"]))
 } 
 else
 { // User ist noch nicht angemeldet 
-	$sql = "select * from User where Nick = '". $_POST["user"]. "'";
+	$sql = "SELECT * FROM `User` WHERE `Nick`='". $_POST["user"]. "'";
 	$userstring = mysql_query($sql, $con);
 
 	// anzahl zeilen
@@ -54,7 +54,7 @@ else
 			$_SESSION['IP'] = $_SERVER['REMOTE_ADDR'];
 		
 			// CVS import Data
-			$SQL = "SELECT * FROM `UserCVS` WHERE UID='".$_SESSION['UID']."'";
+			$SQL = "SELECT * FROM `UserCVS` WHERE `UID`='".$_SESSION['UID']."'";
 			$Erg_CVS =  mysql_query($SQL, $con);
 			$_SESSION['CVS'] = mysql_fetch_array($Erg_CVS);
 			
diff --git a/www-ssl/nonpublic/myschichtplan.php b/www-ssl/nonpublic/myschichtplan.php
index 5aac2b61..be10951b 100755
--- a/www-ssl/nonpublic/myschichtplan.php
+++ b/www-ssl/nonpublic/myschichtplan.php
@@ -88,8 +88,7 @@ else
     {
 	echo Get_Text("pub_mywake_delate1")."<br>\n";
 
-	$sql = "SELECT * FROM `Shifts` WHERE ";
-	$sql.= "(SID = \"". $_GET["SID"]. "\")";
+	$sql = "SELECT * FROM `Shifts` WHERE (`SID` = '". $_GET["SID"]. "')";
 	$Erg = mysql_query($sql, $con);
 
 	$schichtdate = mysql_result( $Erg, 0, "DateS" );
@@ -124,7 +123,7 @@ else
     	echo Get_Text("pub_myshift_Edit_Text1"). "\n";
 	
 	$sql = "SELECT * FROM `ShiftEntry` WHERE ";
-	$sql.= "(SID=\"". $_GET["SID"]. "\" AND UID=\"". $_SESSION['UID']. "\" )";
+	$sql.= "(`SID`='". $_GET["SID"]. "' AND `UID`='". $_SESSION['UID']. "')";
 	$Erg = mysql_query($sql, $con);
 
 	echo "<form action=\"./myschichtplan.php\" method=\"GET\">\n";
@@ -138,7 +137,7 @@ else
     {
     	echo Get_Text("pub_myshift_EditSave_Text1"). "<br>\n";
 	$sql = "UPDATE `ShiftEntry` ".
-	       "SET `Comment` = \"". $_GET["newtext"]. "\" ".
+	       "SET `Comment` = '". $_GET["newtext"]. "' ".
 	       "WHERE `SID`='". $_GET["SID"]. "' AND `UID`='". $_SESSION['UID']. "' LIMIT 1;";
 	$Erg = mysql_query($sql, $con);
 	if ($Erg == 1)
diff --git a/www-ssl/nonpublic/news_comments.php b/www-ssl/nonpublic/news_comments.php
index 6e303cea..a1019765 100755
--- a/www-ssl/nonpublic/news_comments.php
+++ b/www-ssl/nonpublic/news_comments.php
@@ -12,8 +12,8 @@ if( IsSet( $_GET["nid"]))
 
 if( IsSet( $_GET["text"]))
 {
-	$ch_sql="INSERT INTO news_comments (Refid, Datum, Text, UID) VALUES ('".
-		$_GET["nid"]. "', '". date("Y-m-d H:i:s"). "', '". $_GET["text"]. "', '". $_SESSION["UID"]. "')";
+	$ch_sql="INSERT INTO `news_comments` (`Refid`, `Datum`, `Text`, `UID`) ".
+			"VALUES ('". $_GET["nid"]. "', '". date("Y-m-d H:i:s"). "', '". $_GET["text"]. "', '". $_SESSION["UID"]. "')";
 	$Erg = mysql_query($ch_sql, $con);
 	if ($Erg == 1)
 	{
@@ -22,7 +22,7 @@ if( IsSet( $_GET["text"]))
 	}
 }
 
-$SQL = "SELECT * FROM news_comments where Refid = '". $_GET["nid"]. "' ORDER BY 'ID'";
+$SQL = "SELECT * FROM `news_comments` WHERE `Refid`='". $_GET["nid"]. "' ORDER BY 'ID'";
 $Erg = mysql_query($SQL, $con);
 echo mysql_error( $con);
 // anzahl zeilen
diff --git a/www-ssl/nonpublic/news_output.php b/www-ssl/nonpublic/news_output.php
index 6c6fb8ff..b37c9591 100755
--- a/www-ssl/nonpublic/news_output.php
+++ b/www-ssl/nonpublic/news_output.php
@@ -7,9 +7,9 @@ if( isset( $_POST["text"]) && isset( $_POST["betreff"]) && IsSet( $_POST["date"]
 {
   if( !isset( $_POST["treffen"])) 
   	$_POST["treffen"] = 0;
-  $SQL = "INSERT INTO `News` (`Datum`, `Betreff`, `Text`, `UID`, `Treffen`) ";
-  $SQL.= "VALUES ('". $_POST["date"]. "', '". $_POST["betreff"]. "', '". $_POST["text"]. "', '".$_SESSION['UID'];
-  $SQL.= "', '". $_POST["treffen"]. "');";
+  $SQL = "INSERT INTO `News` (`Datum`, `Betreff`, `Text`, `UID`, `Treffen`) ".
+			"VALUES ('". $_POST["date"]. "', '". $_POST["betreff"]. "', '". $_POST["text"]. "', '".$_SESSION['UID'].
+			"', '". $_POST["treffen"]. "');";
   $Erg = mysql_query($SQL, $con);
   if ($Erg == 1)
   	Print_Text(4);
@@ -21,7 +21,7 @@ if( !IsSet( $_GET["news_begin"]))
 if( !IsSet( $_GET["DISPLAY_NEWS"]))
 	$_GET["DISPLAY_NEWS"] = 5;
    
-$SQL = "SELECT * FROM `News` ORDER BY 'ID' DESC LIMIT ". $_GET["news_begin"]. ",". $_GET["DISPLAY_NEWS"];
+$SQL = "SELECT * FROM `News` ORDER BY 'ID' DESC LIMIT ". intval($_GET["news_begin"]). ", ". intval($_GET["DISPLAY_NEWS"]);
 $Erg = mysql_query($SQL, $con);
 
 // anzahl zeilen
@@ -48,14 +48,14 @@ for ($n = 0 ; $n < $news_rows ; $n++)
   echo "</p>\n";
   echo "<p class='answer'>". ReplaceSmilies(nl2br(mysql_result($Erg, $n, "Text"))) ."</p>\n";
   $RefID=mysql_result($Erg, $n, "ID");
-  $countSQL="SELECT COUNT(*) from news_comments where Refid = '$RefID'";
+  $countSQL="SELECT COUNT(*) FROM `news_comments` WHERE `Refid`='$RefID'";
   $countErg = mysql_query($countSQL, $con);
   $countcom = mysql_result($countErg, 0, "COUNT(*)");
   echo "<p class='comment' align='right'><a href=\"./news_comments.php?nid=$RefID\">$countcom comments</a></p>\n\n";
 }
 
 echo "<div align=\"center\">\n\n";
-$rowerg = mysql_query("select * from News", $con);
+$rowerg = mysql_query("SELECT * FROM `News`", $con);
 $rows  = mysql_num_rows($rowerg);
 $dis_rows =  round (($rows / $DISPLAY_NEWS)+0.5);
 
diff --git a/www-ssl/nonpublic/schichtplan_add.php b/www-ssl/nonpublic/schichtplan_add.php
index f12690c7..69170763 100755
--- a/www-ssl/nonpublic/schichtplan_add.php
+++ b/www-ssl/nonpublic/schichtplan_add.php
@@ -35,7 +35,7 @@ if (isset($_POST["newtext"]) && isset($_POST["SID"]) && isset($_POST["TID"])) {
 	{
 		//ermitteln der noch gesuchten
 		$SQL3 = "SELECT * FROM `ShiftEntry`".
-			" WHERE ((`SID` = '". $_POST["SID"]. "') and (`TID` = '". $_POST["TID"]. "') and (`UID` = '0'));";
+			" WHERE ((`SID` = '". $_POST["SID"]. "') AND (`TID` = '". $_POST["TID"]. "') AND (`UID` = '0'));";
 		$Erg3 = mysql_query($SQL3, $con);
 
 		if( mysql_num_rows($Erg3) <= 0 ) 
@@ -65,7 +65,7 @@ elseif (isset($_GET["SID"]) && isset($_GET["TID"])) {
 	"<table border=\"0\">\n";
 
   $SQL = "SELECT * FROM `Shifts` WHERE ";
-  $SQL .="(SID = '". $_GET["SID"]. "')";
+  $SQL .="(`SID` = '". $_GET["SID"]. "')";
   $Erg = mysql_query($SQL, $con);
   
   echo "<tr><td>". Get_Text("pub_schichtplan_add_Date"). ":</td> <td>".
diff --git a/www-ssl/nonpublic/waeckliste.php b/www-ssl/nonpublic/waeckliste.php
index b2c2e420..15e1a4de 100755
--- a/www-ssl/nonpublic/waeckliste.php
+++ b/www-ssl/nonpublic/waeckliste.php
@@ -20,7 +20,7 @@ include ("./inc/header.php");
         </tr>
 						
 <?PHP
-  $sql = "Select * from Wecken order by Date asc";
+  $sql = "SELECT * FROM `Wecken` ORDER BY `Date` ASC";
   $Erg = mysql_query($sql, $con);
   $count = mysql_num_rows($Erg);
 
diff --git a/www-ssl/nonpublic/wecken.php b/www-ssl/nonpublic/wecken.php
index 66597dbb..6758da2b 100755
--- a/www-ssl/nonpublic/wecken.php
+++ b/www-ssl/nonpublic/wecken.php
@@ -8,9 +8,9 @@ include ("./inc/funktion_user.php");
 if( isset($_POST["eintragen"]))
 	if( $_POST["eintragen"] == Get_Text("pub_wake_bouton") ) 
 	{
-		$SQL = "INSERT INTO Wecken (`UID`, `Date`, `Ort`, `Bemerkung`) ".
-			"VALUES (".$_SESSION['UID'].", \"". $_POST["Date"]. "\", \"". $_POST["Ort"]. 
-				"\", \"". $_POST["Bemerkung"]. "\") ";
+		$SQL = "INSERT INTO `Wecken` (`UID`, `Date`, `Ort`, `Bemerkung`) ".
+			"VALUES ('". $_SESSION['UID']. "', '". $_POST["Date"]. "', '". $_POST["Ort"]. "', ".
+					"'". $_POST["Bemerkung"]. "')";
 		$Erg = mysql_query($SQL, $con);
 		if ($Erg == 1) 
 			Print_Text(4);
@@ -18,7 +18,7 @@ if( isset($_POST["eintragen"]))
 if( isset($_GET["eintragen"]))
 	if ($_GET["eintragen"] == "loeschen") 
 	{
-		$SQL = "Delete from Wecken where UID = ".$_SESSION['UID']." and ID = ". $_GET["weckID"]." limit 1";
+		$SQL = "DELETE FROM `Wecken` WHERE `UID`='". $_SESSION['UID']. "' AND `ID`='". $_GET["weckID"]."' LIMIT 1";
 		$Erg = mysql_query($SQL, $con);
 		if ($Erg == 1)
 			Print_Text(4); 
@@ -38,7 +38,7 @@ echo Get_Text("pub_wake_beschreibung2"); ?>
         </tr>
 						
 <?PHP
-  $sql = "Select * from Wecken where UID='".$_SESSION['UID']."' order by Date asc";
+  $sql = "SELECT * FROM `Wecken` WHERE `UID`='". $_SESSION['UID']. "' ORDER BY `Date` ASC";
   $Erg = mysql_query($sql, $con);
   $count = mysql_num_rows($Erg);