s.probst/OpenXE
1
0
Fork 0
mirror of https://github.com/OpenXE-org/OpenXE.git synced 2024-11-14 20:17:14 +01:00
Code Issues Projects Releases Wiki Activity

Shopimport: Fix sql escaping

Browse Source
This commit is contained in:
Andreas Palm 2024-08-12 13:12:02 +02:00
parent 23b9fa781b
commit e1b9428ef5
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
www/lib/class.erpapi.php
View File

@ -16624,9 +16624,10 @@ function Gegenkonto($ust_befreit,$ustid='', $doctype = '', $doctypeId = 0)
$check = $this->app->DB->Select("SELECT $key FROM adresse WHERE id='$adresse' LIMIT 1"); $check = $this->app->DB->Select("SELECT $key FROM adresse WHERE id='$adresse' LIMIT 1");
if($check!=${$key}) if($check!=${$key})
{ {
$this->app->DB->Update("UPDATE adresse SET $key='".${$key}."' WHERE id='$adresse' LIMIT 1"); $val = $this->app->DB->real_escape_string(${$key});
$this->app->DB->Update("UPDATE adresse SET $key='$val' WHERE id='$adresse' LIMIT 1");
$logfile = $this->app->DB->Select("SELECT `logfile` FROM adresse WHERE id='$adresse' LIMIT 1"); $logfile = $this->app->DB->Select("SELECT `logfile` FROM adresse WHERE id='$adresse' LIMIT 1");
$this->app->DB->Update("UPDATE adresse SET `logfile`='".$logfile." Update Feld $key alt:$check neu:".${$key}.";' WHERE id='$adresse' LIMIT 1"); $this->app->DB->Update("UPDATE adresse SET `logfile`='".$logfile." Update Feld $key alt:$check neu:".$val.";' WHERE id='$adresse' LIMIT 1");
} }
} }