From 3f8cf2ca9beb7ef7ccd84912391e3e351be0985b Mon Sep 17 00:00:00 2001
From: cookie <cookie@29ba0400-6e00-0410-a75a-ca02368028f8>
Date: Mon, 11 Dec 2006 07:47:43 +0000
Subject: sql injektion gemeldet by sven

git-svn-id: svn://svn.cccv.de/engel-system@204 29ba0400-6e00-0410-a75a-ca02368028f8
---
 www-ssl/admin/schichtplan.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'www-ssl/admin')

diff --git a/www-ssl/admin/schichtplan.php b/www-ssl/admin/schichtplan.php
index 12c767c2..3bf2bb4f 100755
--- a/www-ssl/admin/schichtplan.php
+++ b/www-ssl/admin/schichtplan.php
@@ -40,7 +40,7 @@ echo "<form action=\"".$_SERVER['SCRIPT_NAME']."\" method=\"GET\" >\n";
 <?PHP
 
 $sql =  "SELECT `SID`, `DateS`, `RID`, `Len` FROM `Shifts` ".
-	"ORDER BY RID, DateS ";
+	"ORDER BY `RID`, `DateS` ";
 $Erg = mysql_query($sql, $con);
 $rowcount = mysql_num_rows($Erg);
 for( $i = 0; $i < $rowcount; $i++)
@@ -300,7 +300,7 @@ case 'changesave':
 			"`Len`='". $_GET["eDauer"]. "', ".
 			"`Man`='". $_GET["eName"]. "', ".
 			"`URL`='". $_GET["eURL"]. "' ".
-			"WHERE `SID`=". $_GET["SID"];
+			"WHERE `SID`='". $_GET["SID"]. "'";
 	SetHeaderGo2Back();
 	break;
 	
@@ -315,10 +315,10 @@ case 'deleteShifs':
 		if( strpos( " ".$k, "SID") == 1)
 		{
 			echo "Shifts $v wird gelöscht...";
-			executeSQL( "DELETE FROM `Shifts` WHERE `SID`=$v LIMIT 1");
+			executeSQL( "DELETE FROM `Shifts` WHERE `SID`='$v' LIMIT 1");
 			echo "<br>\n";
 			echo "ShiftEntry $v wird gelöscht...";
-			executeSQL( "DELETE FROM `ShiftEntry` WHERE `SID`= $v");
+			executeSQL( "DELETE FROM `ShiftEntry` WHERE `SID`='$v'");
 			echo "<br><br>\n";
 		}
 	break;
-- 
cgit v1.2.3-54-g00ecf