xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-07-24 21:46:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: security patching due to mysql injection vulnerabilities everywhere

Browse Source
This commit is contained in:
Martin Ambrus
2017-10-17 12:21:41 +02:00
parent 74cccb2a74
commit 1654ce498f
10 changed files with 694 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Templates/Build/37_hero.tpl
+3 -2
View File
@@ -9,11 +9,12 @@
| Copyright: TravianX Project All rights reserved |
\*-------------------------------------------------------*/
include_once("GameEngine/Data/hero_full.php");
include_once("GameEngine/Data/hero_full.php");
global $database;
if (isset($_POST['name'])) {
$_POST['name'] = stripslashes($_POST['name']);
mysqli_query($GLOBALS['link'],"UPDATE ".TB_PREFIX."hero SET `name`='".($_POST['name'])."' where `uid`='".$session->uid."'") or die("ERROR:".mysqli_error());
mysqli_query($GLOBALS['link'],"UPDATE ".TB_PREFIX."hero SET `name`='".($database->escape($_POST['name']))."' where `uid`='".$session->uid."'") or die("ERROR:".mysqli_error());
$hero = mysqli_query("SELECT * FROM " . TB_PREFIX . "hero WHERE `uid` = " . $session->uid . "");
$hero_info = mysqli_fetch_array($hero);
echo "".NAME_CHANGED."";