Changeset 4786 for trunk/phpgwapi/inc/class.categories.inc.php

Timestamp:

07/19/11 08:35:15 (13 years ago)

Author:

roberto.santosjunior

Message:

Ticket #1820 - Incluído 'escape' para evitar sql injection, em class.categories.inc.php. r4632

File:

• trunk/phpgwapi/inc/class.categories.inc.php (modified) (1 diff)

trunk/phpgwapi/inc/class.categories.inc.php

@@ -253 +253 @@
                         }
 
-
+                        $this->app_name = pg_escape_string($this->app_name);
                         $sql = "SELECT".$table_column."FROM phpgw_categories WHERE (cat_appname='" . $this->app_name. "' ".
                                         ($grant_cats ? " AND".$grant_cats : "") .($global_cats ? " OR".$global_cats: "").