aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--admin/group_list.php2
-rw-r--r--admin/history.php2
-rw-r--r--admin/template/goto/install.tpl2
-rw-r--r--admin/user_list.php9
-rw-r--r--include/functions_user.inc.php4
-rw-r--r--language/fr_FR/install.lang.php2
-rw-r--r--password.php2
7 files changed, 8 insertions, 15 deletions
diff --git a/admin/group_list.php b/admin/group_list.php
index 09462025e..8bb0412b4 100644
--- a/admin/group_list.php
+++ b/admin/group_list.php
@@ -107,7 +107,7 @@ SELECT COUNT(*)
INSERT INTO '.GROUPS_TABLE.'
(name)
VALUES
- (\''.mysql_escape_string($_POST['groupname']).'\')
+ (\''.mysql_real_escape_string($_POST['groupname']).'\')
;';
pwg_query($query);
diff --git a/admin/history.php b/admin/history.php
index 222deaaf1..a915704d4 100644
--- a/admin/history.php
+++ b/admin/history.php
@@ -110,7 +110,7 @@ if (isset($_POST['submit']))
$search['fields']['filename'] = str_replace(
'*',
'%',
- mysql_escape_string($_POST['filename'])
+ mysql_real_escape_string($_POST['filename'])
);
}
diff --git a/admin/template/goto/install.tpl b/admin/template/goto/install.tpl
index 0fdf9b709..553eb737d 100644
--- a/admin/template/goto/install.tpl
+++ b/admin/template/goto/install.tpl
@@ -29,7 +29,7 @@ TD {
height: 2.5em;
}
-.sql_content {
+.sql_content, .infos a {
color: #ff3363;
}
</style>
diff --git a/admin/user_list.php b/admin/user_list.php
index 8f0430ee5..80d3306f7 100644
--- a/admin/user_list.php
+++ b/admin/user_list.php
@@ -49,14 +49,7 @@ function get_filtered_user_list()
if (isset($_GET['username']) and !empty($_GET['username']))
{
$username = str_replace('*', '%', $_GET['username']);
- if (function_exists('mysql_real_escape_string'))
- {
- $filter['username'] = mysql_real_escape_string($username);
- }
- else
- {
- $filter['username'] = mysql_escape_string($username);
- }
+ $filter['username'] = mysql_real_escape_string($username);
}
if (isset($_GET['group'])
diff --git a/include/functions_user.inc.php b/include/functions_user.inc.php
index 472487342..02aa2a5d8 100644
--- a/include/functions_user.inc.php
+++ b/include/functions_user.inc.php
@@ -115,7 +115,7 @@ SELECT MAX('.$conf['user_fields']['id'].') + 1
$insert =
array(
$conf['user_fields']['id'] => $next_id,
- $conf['user_fields']['username'] => mysql_escape_string($login),
+ $conf['user_fields']['username'] => mysql_real_escape_string($login),
$conf['user_fields']['password'] => $conf['pass_convert']($password),
$conf['user_fields']['email'] => $mail_address
);
@@ -716,7 +716,7 @@ function get_userid($username)
{
global $conf;
- $username = mysql_escape_string($username);
+ $username = mysql_real_escape_string($username);
$query = '
SELECT '.$conf['user_fields']['id'].'
diff --git a/language/fr_FR/install.lang.php b/language/fr_FR/install.lang.php
index 012499550..6e90429e8 100644
--- a/language/fr_FR/install.lang.php
+++ b/language/fr_FR/install.lang.php
@@ -59,7 +59,7 @@ $lang['install_help'] = 'Besoin d\'aide ? Posez votre question sur le <a href="%
$lang['install_end_message'] = 'La configuration de l\'application s\'est correctement déroulée, place à la prochaine étape<br /><br />
Par mesure de sécurité, merci de supprimer le fichier "install.php"<br />
Un fois ce fichier supprimé, veuillez suivre ces indications :<br />
-* allez sur la page d\'identification : [ <a href="./identification.php">identification</a> ] et connectez-vous avec le pseudo donné pour le webmasterbr<br />
+* allez sur la page d\'identification : [ <a href="./identification.php">identification</a> ] et connectez-vous avec le pseudo donné pour le webmaster<br />
* celui-ci vous permet d\'accéder à la partie administration et aux instructions pour placer les images dans les répertoires.';
$lang['conf_mail_webmaster'] = 'Adresse e-mail de l\'Administrateur';
$lang['conf_mail_webmaster_info'] = 'Les visiteurs pourront vous contacter par ce mail';
diff --git a/password.php b/password.php
index 2161188b7..0a7ca4b87 100644
--- a/password.php
+++ b/password.php
@@ -56,7 +56,7 @@ if (isset($_POST['submit']))
}
else if (isset($_POST['mail_address']) and !empty($_POST['mail_address']))
{
- $mail_address = mysql_escape_string($_POST['mail_address']);
+ $mail_address = mysql_real_escape_string($_POST['mail_address']);
$query = '
SELECT '.$conf['user_fields']['id'].' AS id