Changeset 3258

Timestamp:

09/16/10 16:29:57 (14 years ago)

Author:

rafaelraymundo

Message:

Ticket #1300 - Escapando strings das variaveis usadas pelo help.php no sql.

File:

• branches/2.2/phpgwapi/inc/class.translation_sql.inc.php (modified) (1 diff)

branches/2.2/phpgwapi/inc/class.translation_sql.inc.php

@@ -229 +229 @@
                         if (!isset($this->loaded_apps[$app]) || $this->loaded_apps[$app] != $lang)
                         {
-                                $sql = "select message_id,content from phpgw_lang where lang='".$lang."' and app_name='".$app."'";
+                                $sql = "select message_id,content from phpgw_lang where lang='".pg_escape_string($lang)."' and app_name='".pg_escape_string($app)."'";
                                 $this->db->query($sql,__LINE__,__FILE__);
                                 while ($this->db->next_record())