mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-07 01:06:48 +02:00
Code Issues Releases Wiki Activity

- adjust unread query a bit to cope with large topics (thanks bart!)

Browse Source 
- fixing some bugs
- more username_clean work


git-svn-id: file:///svn/phpbb/trunk@6513 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Meik Sievertsen
2006-10-20 13:48:44 +00:00
parent b572e0db8f
commit f4da66a932
19 changed files with 94 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
phpBB/includes/mcp/mcp_notes.php
View File

@@ -68,13 +68,13 @@ class mcp_notes
global $template, $db, $user, $auth;
$user_id = request_var('u', 0);
$username = request_var('username', '');
$username = request_var('username', '', true);
$start = request_var('start', 0);
$st = request_var('st', 0);
$sk = request_var('sk', 'b');
$sd = request_var('sd', 'd');
$sql_where = ($user_id) ? "user_id = $user_id" : "username = '" . $db->sql_escape($username) . "'";
$sql_where = ($user_id) ? "user_id = $user_id" : "username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
$sql = 'SELECT *
FROM ' . USERS_TABLE . "

4
phpBB/includes/mcp/mcp_post.php
View File

@@ -59,8 +59,8 @@ function mcp_post_details($id, $mode, $action)
if ($action == 'chgposter')
{
$username = request_var('username', '');
$sql_where = "username = '" . $db->sql_escape($username) . "'";
$username = request_var('username', '', true);
$sql_where = "username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
}
else
{

4
phpBB/includes/mcp/mcp_warn.php
View File

@@ -310,11 +310,11 @@ function mcp_warn_user_view($id, $mode, $action)
global $template, $db, $user, $auth;
$user_id = request_var('u', 0);
$username = request_var('username', '');
$username = request_var('username', '', true);
$notify = (isset($_REQUEST['notify_user'])) ? true : false;
$warning = request_var('warning', '', true);
$sql_where = ($user_id) ? "user_id = $user_id" : "username = '" . $db->sql_escape($username) . "'";
$sql_where = ($user_id) ? "user_id = $user_id" : "username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
$sql = 'SELECT *
FROM ' . USERS_TABLE . '