From de1ff24582c161cab972cb455355c91ee3e8222a Mon Sep 17 00:00:00 2001
From: nikrou <nikrou@piwigo.org>
Date: Fri, 21 Jul 2006 13:44:22 +0000
Subject: bug 471 fixed: quote in tags

git-svn-id: http://piwigo.org/svn/trunk@1487 68402e56-0260-453c-a942-63ccdbb3a9ee
---
 admin/tags.php | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

(limited to 'admin/tags.php')

diff --git a/admin/tags.php b/admin/tags.php
index 21000de98..95c6f7d77 100644
--- a/admin/tags.php
+++ b/admin/tags.php
@@ -149,20 +149,13 @@ DELETE
 
 if (isset($_POST['add']) and !empty($_POST['add_tag']))
 {
-  if (function_exists('mysql_real_escape_string'))
-  {
-    $tag_name = mysql_real_escape_string($_POST['add_tag']);
-  }
-  else
-  {
-    $tag_name = mysql_escape_string($_POST['add_tag']);
-  }
+  $tag_name = $_POST['add_tag'];
 
   // does the tag already exists?
   $query = '
 SELECT id
   FROM '.TAGS_TABLE.'
-  WHERE name = \''.$tag_name.'\'
+  WHERE name = \''.pwg_quotemeta($tag_name).'\'
 ;';
   $existing_tags = array_from_query($query, 'id');
 
@@ -173,7 +166,7 @@ SELECT id
       array('name', 'url_name'),
       array(
         array(
-          'name' => $tag_name,
+          'name' => pwg_quotemeta($tag_name),
           'url_name' => str2url($tag_name),
           )
         )
@@ -183,7 +176,7 @@ SELECT id
       $page['infos'],
       sprintf(
         l10n('Tag "%s" was added'),
-        $tag_name
+        pwg_stripslashes($tag_name)
         )
       );
   }
@@ -193,7 +186,7 @@ SELECT id
       $page['errors'],
       sprintf(
         l10n('Tag "%s" already exists'),
-        $tag_name
+        pwg_stripslashes($tag_name)
         )
       );
   }
-- 
cgit v1.2.3