From 6bede2fd229395f34c321a37efa2ea93e7b1a7ba Mon Sep 17 00:00:00 2001
From: Philip Häusler <msquare@notrademark.de>
Date: Sun, 28 Dec 2014 13:44:56 +0100
Subject: harden the sql queries

---
 includes/pages/admin_news.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'includes/pages/admin_news.php')

diff --git a/includes/pages/admin_news.php b/includes/pages/admin_news.php
index a4474ff9..1c435a14 100644
--- a/includes/pages/admin_news.php
+++ b/includes/pages/admin_news.php
@@ -11,7 +11,7 @@ function admin_news() {
     else
       return error("Incomplete call, missing News ID.", true);
     
-    $news = sql_select("SELECT * FROM `News` WHERE `ID`=" . sql_escape($id) . " LIMIT 1");
+    $news = sql_select("SELECT * FROM `News` WHERE `ID`='" . sql_escape($id) . "' LIMIT 1");
     if (count($news) > 0) {
       switch ($_REQUEST["action"]) {
         default:
@@ -44,7 +44,7 @@ function admin_news() {
               `Text`='" . sql_escape($_POST["eText"]) . "', 
               `UID`='" . sql_escape($user['UID']) . "', 
               `Treffen`='" . sql_escape($_POST["eTreffen"]) . "' 
-              WHERE `ID`=" . sql_escape($id));
+              WHERE `ID`='" . sql_escape($id) . "'");
           engelsystem_log("News updated: " . $_POST["eBetreff"]);
           success(_("News entry updated."));
           redirect(page_link_to("news"));
@@ -53,7 +53,7 @@ function admin_news() {
         case 'delete':
           list($news) = $news;
           
-          sql_query("DELETE FROM `News` WHERE `ID`=" . sql_escape($id) . " LIMIT 1");
+          sql_query("DELETE FROM `News` WHERE `ID`='" . sql_escape($id) . "' LIMIT 1");
           engelsystem_log("News deleted: " . $news['Betreff']);
           success(_("News entry deleted."));
           redirect(page_link_to("news"));
-- 
cgit v1.2.3-54-g00ecf