gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-15 06:01:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

- call qstr() for name and comment

Browse Source
This commit is contained in:
steinm 2011-12-03 16:20:05 +00:00
parent d332984803
commit 6e0df090c6
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
LetoDMS_Core/Core/inc.ClassFolder.php
View File

@ -127,7 +127,7 @@ class LetoDMS_Core_Folder {
function setName($newName) { /* {{{ */ function setName($newName) { /* {{{ */
$db = $this->_dms->getDB(); $db = $this->_dms->getDB();
$queryStr = "UPDATE tblFolders SET name = '" . $newName . "' WHERE id = ". $this->_id; $queryStr = "UPDATE tblFolders SET name = " . $db->qstr($newName) . " WHERE id = ". $this->_id;
if (!$db->getResult($queryStr)) if (!$db->getResult($queryStr))
return false; return false;
@ -141,7 +141,7 @@ class LetoDMS_Core_Folder {
function setComment($newComment) { /* {{{ */ function setComment($newComment) { /* {{{ */
$db = $this->_dms->getDB(); $db = $this->_dms->getDB();
$queryStr = "UPDATE tblFolders SET comment = '" . $newComment . "' WHERE id = ". $this->_id; $queryStr = "UPDATE tblFolders SET comment = " . $db->qstr($newComment) . " WHERE id = ". $this->_id;
if (!$db->getResult($queryStr)) if (!$db->getResult($queryStr))
return false; return false;