From a52ee4a288ec57c2983173460237e4137440a873 Mon Sep 17 00:00:00 2001
From: cookie <cookie@29ba0400-6e00-0410-a75a-ca02368028f8>
Date: Mon, 4 Dec 2006 19:54:51 +0000
Subject: SQL injektion behoben

git-svn-id: svn://svn.cccv.de/engel-system@198 29ba0400-6e00-0410-a75a-ca02368028f8
---
 www-ssl/admin/tshirt.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'www-ssl/admin/tshirt.php')

diff --git a/www-ssl/admin/tshirt.php b/www-ssl/admin/tshirt.php
index 2e843e92..87dc1c73 100755
--- a/www-ssl/admin/tshirt.php
+++ b/www-ssl/admin/tshirt.php
@@ -9,7 +9,7 @@ include ("./inc/funktion_user.php");
 
 If (IsSet($_GET["aktiv"])) {
 
-	$SQL="Update User set Tshirt=\"1\" where UID=\"". $_GET["aktiv"]. "\" limit 1";
+	$SQL="UPDATE `User` SET `Tshirt`='1' WHERE `UID`='". $_GET["aktiv"]. "' limit 1";
 	$Erg = mysql_query($SQL, $con);
         if ($Erg == 1) {
         } else {
@@ -25,7 +25,7 @@ Hinter diesem erscheint ein Link, &uuml;ber den man eintragen kann, dass der Eng
 Liste aller aktiven Engel:
 
 <?PHP
-$SQL = "SELECT * from User where (Aktiv = 1) ORDER BY Nick ASC"; 
+$SQL = "SELECT * FROM `User` WHERE (`Aktiv`='1') ORDER BY `Nick` ASC"; 
 $Erg = mysql_query($SQL, $con);
 
 $rowcount = mysql_num_rows($Erg);
-- 
cgit v1.2.3-70-g09d2