lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Suppression des addslashes. En effet, les donnes ne doivent jamais contenir une valeur "transforme" de leur valeur mais c'est uniquement dans l'ordre insert que le addslashes doit etre ajout. Ceci ces donnes peuvent etre manipules par d'autres portions de code que le insert qui elle requiert la donne d'origine.

Browse Source
This commit is contained in:
Laurent Destailleur 2006-06-07 20:10:06 +00:00
parent c5a5f07e7b
commit 50dca584c4
2 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
htdocs/facture.class.php
View File

@ -1007,8 +1007,7 @@ class Facture
if (! $ventil) $ventil=0; if (! $ventil) $ventil=0;
$soc = new Societe($this->db); $soc = new Societe($this->db);
$soc->fetch($this->socidp); $soc->fetch($this->socidp);
if($soc->tva_assuj == "0") if($soc->tva_assuj == "0") $txtva ="0";
$txtva ="0";
dolibarr_syslog("facture.class.php:: txtva : ".$txtva); dolibarr_syslog("facture.class.php:: txtva : ".$txtva);
if ($fk_product && ! $pu) if ($fk_product && ! $pu)
{ {
@ -1059,13 +1058,13 @@ class Facture
$rangmax = $row[0]; $rangmax = $row[0];
} }
if ($conf->global->PRODUIT_CHANGE_PROD_DESC) if ($conf->global->PRODUIT_CHANGE_PROD_DESC)
{ {
if (!$product_desc) if (!$product_desc)
{ {
$product_desc = $desc; $product_desc = $desc;
} }
} }
// Formatage des prix // Formatage des prix
$price = price2num($price); $price = price2num($price);

6
htdocs/product.class.php
View File

@ -208,9 +208,9 @@ class Product
if (! $this->libelle) $this->libelle = 'LIBELLE MANQUANT'; if (! $this->libelle) $this->libelle = 'LIBELLE MANQUANT';
$this->ref = trim(sanitize_string($this->ref)); $this->ref = trim(sanitize_string($this->ref));
$this->libelle = trim(addslashes($this->libelle)); $this->libelle = trim($this->libelle);
$this->description = trim(addslashes($this->description)); $this->description = trim($this->description);
$this->note = trim(addslashes($this->note)); $this->note = trim($this->note);
$sql = "UPDATE ".MAIN_DB_PREFIX."product "; $sql = "UPDATE ".MAIN_DB_PREFIX."product ";
$sql .= " SET label = '" . addslashes($this->libelle) ."'"; $sql .= " SET label = '" . addslashes($this->libelle) ."'";