lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: On corrige autrement le pb des quot sur contact car le addshlashes doit etre au niveau de la request insert ou update (propre la base) et non au niveau des manipulations mtiers

Browse Source
This commit is contained in:
Laurent Destailleur 2006-02-08 19:38:25 +00:00
parent 84bc54cfca
commit 879d434b6a
2 changed files with 1399 additions and 1399 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
htdocs/contact.class.php
View File

@ -139,22 +139,22 @@ class Contact
} }
$sql = "UPDATE ".MAIN_DB_PREFIX."socpeople SET "; $sql = "UPDATE ".MAIN_DB_PREFIX."socpeople SET ";
$sql .= " civilite='$this->civilite_id'"; $sql .= " civilite='".addslashes($this->civilite_id)."'";
$sql .= ", name='$this->name'"; $sql .= ", name='".addslashes($this->name)."'";
$sql .= ", firstname='$this->firstname'"; $sql .= ", firstname='".addslashes($this->firstname)."'";
$sql .= ", address='$this->address'"; $sql .= ", address='".addslashes($this->address)."'";
$sql .= ", cp='$this->cp'"; $sql .= ", cp='".addslashes($this->cp)."'";
$sql .= ", ville='$this->ville'"; $sql .= ", ville='".addslashes($this->ville)."'";
$sql .= ", fk_pays='$this->fk_pays'"; $sql .= ", fk_pays='".addslashes($this->fk_pays)."'";
$sql .= ", poste='$this->poste'"; $sql .= ", poste='".addslashes($this->poste)."'";
$sql .= ", fax='$this->fax'"; $sql .= ", fax='".addslashes($this->fax)."'";
$sql .= ", email='$this->email'"; $sql .= ", email='".addslashes($this->email)."'";
$sql .= ", note='$this->note'"; $sql .= ", note='".addslashes($this->note)."'";
$sql .= ", phone = '$this->phone_pro'"; $sql .= ", phone = '".addslashes($this->phone_pro)."'";
$sql .= ", phone_perso = '$this->phone_perso'"; $sql .= ", phone_perso = '".addslashes($this->phone_perso)."'";
$sql .= ", phone_mobile = '$this->phone_mobile'"; $sql .= ", phone_mobile = '".addslashes($this->phone_mobile)."'";
$sql .= ", jabberid = '$this->jabberid'"; $sql .= ", jabberid = '".addslashes($this->jabberid)."'";
if ($user) $sql .= ", fk_user_modif='".$user->id."'"; if ($user) $sql .= ", fk_user_modif=".$user->id;
$sql .= " WHERE idp=".$id; $sql .= " WHERE idp=".$id;
$result = $this->db->query($sql); $result = $this->db->query($sql);

24
htdocs/contact/fiche.php
View File

@ -59,13 +59,13 @@ if ($_POST["action"] == 'add')
$contact->socid = $_POST["socid"]; $contact->socid = $_POST["socid"];
$contact->name = addslashes($_POST["name"]); $contact->name = $_POST["name"];
$contact->firstname = addslashes($_POST["firstname"]); $contact->firstname = $_POST["firstname"];
$contact->civilite_id = $_POST["civilite_id"]; $contact->civilite_id = $_POST["civilite_id"];
$contact->poste = addslashes($_POST["poste"]); $contact->poste = $_POST["poste"];
$contact->address = addslashes($_POST["address"]); $contact->address = $_POST["address"];
$contact->cp = $_POST["cp"]; $contact->cp = $_POST["cp"];
$contact->ville = addslashes($_POST["ville"]); $contact->ville = $_POST["ville"];
$contact->fk_pays = $_POST["pays_id"]; $contact->fk_pays = $_POST["pays_id"];
$contact->email = $_POST["email"]; $contact->email = $_POST["email"];
$contact->phone_pro = $_POST["phone_pro"]; $contact->phone_pro = $_POST["phone_pro"];
@ -74,7 +74,7 @@ if ($_POST["action"] == 'add')
$contact->fax = $_POST["fax"]; $contact->fax = $_POST["fax"];
$contact->jabberid = $_POST["jabberid"]; $contact->jabberid = $_POST["jabberid"];
$contact->note = addslashes($_POST["note"]); $contact->note = $_POST["note"];
if (! $_POST["name"]) if (! $_POST["name"])
{ {
@ -117,14 +117,14 @@ if ($_POST["action"] == 'update')
$contact->old_firstname = $_POST["old_firstname"]; $contact->old_firstname = $_POST["old_firstname"];
$contact->socid = $_POST["socid"]; $contact->socid = $_POST["socid"];
$contact->name = addslashes($_POST["name"]); $contact->name = $_POST["name"];
$contact->firstname = addslashes($_POST["firstname"]); $contact->firstname = $_POST["firstname"];
$contact->civilite_id = $_POST["civilite_id"]; $contact->civilite_id = $_POST["civilite_id"];
$contact->poste = addslashes($_POST["poste"]); $contact->poste = $_POST["poste"];
$contact->address = addslashes($_POST["address"]); $contact->address = $_POST["address"];
$contact->cp = $_POST["cp"]; $contact->cp = $_POST["cp"];
$contact->ville = addslashes($_POST["ville"]); $contact->ville = $_POST["ville"];
$contact->fk_pays = $_POST["pays_id"]; $contact->fk_pays = $_POST["pays_id"];
$contact->email = $_POST["email"]; $contact->email = $_POST["email"];
@ -134,7 +134,7 @@ if ($_POST["action"] == 'update')
$contact->fax = $_POST["fax"]; $contact->fax = $_POST["fax"];
$contact->jabberid = $_POST["jabberid"]; $contact->jabberid = $_POST["jabberid"];
$contact->note = addslashes($_POST["note"]); $contact->note = $_POST["note"];
$result = $contact->update($_POST["contactid"], $user); $result = $contact->update($_POST["contactid"], $user);