[geeklog-devel] [geeklog-cvs] Geeklog-1.x/public_html/links index.php

[Joe Mucchiello]

At 05:41 AM 12/31/2007, Dirk Haun wrote:

>       $cid = $_LI_CONF['root'];
>       $display = '';
>!     if (isset($_GET['category'])) {
>!         $cid = strip_tags (COM_stripslashes ($_GET['category']));
>!     } elseif (isset($_POST['category'])) {
>!         $cid = strip_tags (COM_stripslashes ($_POST['category']));
>
>--- 261,266 ----
>       } else {
>           // Get current category name
>!         $currentcategory = DB_getItem($_TABLES['linkcategories'], 
>'category',
>!                                       "cid='{$cid}'");

You probably need an addslashes here. If you're calling strip_tags, 
that means "Jim's Links" is a valid $cid.


----
Joe Mucchiello
Throwing Dice Games
http://www.throwingdice.com