diff options
| author | Karl 'vollmerk' Vollmer <vollmer@ampache.org> | 2009-03-16 15:11:59 +0000 |
|---|---|---|
| committer | Karl 'vollmerk' Vollmer <vollmer@ampache.org> | 2009-03-16 15:11:59 +0000 |
| commit | f42230b1339eb47bf10e0c72a45828f8ef81d1c8 (patch) | |
| tree | 25ae28fb7c9ff64abb4385dd9ba9203e8ce66b89 /lib/class/artist.class.php | |
| parent | de10c44c65c30f0017baa05c0c0744e29fcb7177 (diff) | |
| download | ampache-f42230b1339eb47bf10e0c72a45828f8ef81d1c8.tar.gz ampache-f42230b1339eb47bf10e0c72a45828f8ef81d1c8.tar.bz2 ampache-f42230b1339eb47bf10e0c72a45828f8ef81d1c8.zip | |
Dba::escape() must be used around all user input in queries
Diffstat (limited to 'lib/class/artist.class.php')
| -rw-r--r-- | lib/class/artist.class.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/class/artist.class.php b/lib/class/artist.class.php index d4caf29f..c55b109e 100644 --- a/lib/class/artist.class.php +++ b/lib/class/artist.class.php @@ -315,7 +315,7 @@ class Artist extends database_object { $lyrics = mb_convert_encoding($lyrics, "UTF-8", $enc); } } - $sql = "UPDATE `song_data` SET `lyrics` = '" . htmlspecialchars($lyrics, ENT_QUOTES) . "' WHERE `song_id`='" . Dba::escape($song_id) . "'"; + $sql = "UPDATE `song_data` SET `lyrics` = '" . Dba::escape(htmlspecialchars($lyrics, ENT_QUOTES)) . "' WHERE `song_id`='" . Dba::escape($song_id) . "'"; $db_results = Dba::write($sql); debug_event("lyrics", "Use id3v2 tag (USLT or lyrics3)", "5"); @@ -361,7 +361,7 @@ class Artist extends database_object { else { $lyrics = str_replace(array("\r\n","\r","\n"), '<br />',strip_tags($result['lyrics'])); // since we got lyrics, might as well add them to the database now (for future use) - $sql = "UPDATE `song_data` SET `lyrics` = '" . htmlspecialchars($lyrics, ENT_QUOTES) . "' WHERE `song_id`='" . Dba::escape($song_id) . "'"; + $sql = "UPDATE `song_data` SET `lyrics` = '" . Dba::escape(htmlspecialchars($lyrics, ENT_QUOTES)) . "' WHERE `song_id`='" . Dba::escape($song_id) . "'"; $db_results = Dba::write($sql); // display result (lyrics) debug_event("lyrics", "get successful", "5"); |