arman/science-ation
1
1
Fork 0
forked from science-ation/science-ation
Code Pull Requests Activity

A few more missed escapes

Browse Source
This commit is contained in:
james 2012-10-22 18:40:16 +00:00
parent 1c10dda679
commit 88f1cc7614
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
admin/reports.inc.php
View File

@ -354,12 +354,12 @@ foreach($report_stock as $n=>$v) {
foreach($report[$type] as $k=>$v) {
if($type == 'option') {
/* field, value, x, y, w, h, lines, face, align, valign, fn, fs, fsize, overflow */
$vals = "'$k','$v','0','0','0','0','0','','','','','','0','truncate'";
$vals = "'".mysql_real_escape_string($k)."','".mysql_real_escape_string($v)."','0','0','0','0','0','','','','','','0','truncate'";
} else {
if($v['lines'] == 0) $v['lines'] =1;
$fs = is_array($v['fontstyle']) ? implode(',',$v['fontstyle']) : '';
$opts = "{$v['align']} {$v['valign']}";
$vals = "'{$v['field']}','{$v['value']}',
$vals = "'{$v['field']}','".mysql_real_escape_string($v['value'])."',
'{$v['x']}','{$v['y']}','{$v['w']}',
'{$v['h']}','{$v['lines']}','{$v['face']}',
'$opts','{$v['valign']}',