From 4ddbffe4bb96b7081ca040f237539dcb7c568530 Mon Sep 17 00:00:00 2001
From: james <james>
Date: Tue, 5 Oct 2010 20:18:32 +0000
Subject: [PATCH] Oops, guess i should test before committing -- this fixes the
 syntax error, as well as allows more weird chars to be properly set and saved
 as division/category titles

---
 config/categories.php   | 8 ++++----
 config/divisions.php    | 4 ++--
 config/subdivisions.php | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/config/categories.php b/config/categories.php
index f063885b..23484669 100644
--- a/config/categories.php
+++ b/config/categories.php
@@ -49,7 +49,7 @@
 			mysql_query("UPDATE projectcategories SET ".
 				"id='".intval($_POST['id'])."', ".
 				"category='".mysql_real_escape_string($_POST['category'])."', ".
-				"category_shortform='".mysql_real_escape_string(($_POST['category_shortform'])."', ".
+				"category_shortform='".mysql_real_escape_string($_POST['category_shortform'])."', ".
 				"mingrade='".intval($_POST['mingrade'])."', ".
 				"maxgrade='".intval($_POST['maxgrade'])."' ".
 				"WHERE id='".intval($_POST['saveid'])."'");
@@ -70,7 +70,7 @@
 		}
 		else {
 			mysql_query("INSERT INTO projectcategories (id,category,category_shortform,mingrade,maxgrade,conferences_id) VALUES ( ".
-				"'".intval($_POST['id']."', ".
+				"'".intval($_POST['id'])."', ".
 				"'".mysql_real_escape_string($_POST['category'])."', ".
 				"'".mysql_real_escape_string($_POST['category_shortform'])."', ".
 				"'".intval($_POST['mingrade'])."', ".
@@ -121,8 +121,8 @@
 	}
 	echo "<tr>";
 	echo " <td><input type=\"text\" size=\"3\" name=\"id\" value=\"$categoryr->id\"></td>";
-	echo " <td><input type=\"text\" size=\"20\" name=\"category\" value=\"$categoryr->category\"></td>";
-	echo " <td><input type=\"text\" size=\"5\" name=\"category_shortform\" value=\"$categoryr->category_shortform\"></td>";
+	echo " <td><input type=\"text\" size=\"20\" name=\"category\" value=\"".htmlentities($categoryr->category)."\"></td>";
+	echo " <td><input type=\"text\" size=\"5\" name=\"category_shortform\" value=\"".htmlentities($categoryr->category_shortform)."\"></td>";
 	echo " <td><input type=\"text\" size=\"3\" name=\"mingrade\" value=\"$categoryr->mingrade\"></td>";
 	echo " <td><input type=\"text\" size=\"3\" name=\"maxgrade\" value=\"$categoryr->maxgrade\"></td>";
 	echo " <td><input type=\"submit\" value=\"".i18n($buttontext)."\"></td>";
diff --git a/config/divisions.php b/config/divisions.php
index 8d37c54b..23863f1d 100644
--- a/config/divisions.php
+++ b/config/divisions.php
@@ -146,8 +146,8 @@ if($_GET['action']=="edit" || $_GET['action']=="new") {
 	}
 	echo "<tr>";
 	echo " <td><input type=\"text\" size=\"3\" name=\"id\" value=\"$divisionr->id\" /></td>";
-	echo " <td><input type=\"text\" size=\"40\" name=\"division\" value=\"$divisionr->division\" /></td>";
-	echo " <td align=\"center\"><input type=\"text\" size=\"5\" name=\"division_shortform\" value=\"$divisionr->division_shortform\" /></td>";
+	echo " <td><input type=\"text\" size=\"40\" name=\"division\" value=\"".htmlentities($divisionr->division)."\" /></td>";
+	echo " <td align=\"center\"><input type=\"text\" size=\"5\" name=\"division_shortform\" value=\"".htmlentities($divisionr->division_shortform)."\" /></td>";
 	
 	//###### Feature Specific - filtering divisions by category
 	if($config['filterdivisionbycategory']=="yes"){
diff --git a/config/subdivisions.php b/config/subdivisions.php
index 049d2dbe..e5b8a54e 100644
--- a/config/subdivisions.php
+++ b/config/subdivisions.php
@@ -126,7 +126,7 @@
 	echo "</select>";
 	echo "</td>";
 	echo " <td><input type=\"text\" size=\"3\" name=\"id\" value=\"$divisionr->id\"></td>";
-	echo " <td><input type=\"text\" size=\"30\" name=\"subdivision\" value=\"$divisionr->subdivision\"></td>";
+	echo " <td><input type=\"text\" size=\"30\" name=\"subdivision\" value=\"".htmlentities($divisionr->subdivision)."\"></td>";
 	echo " <td><input type=\"submit\" value=\"".i18n($buttontext)."\"></td>";
 	echo "</tr>";
  }