xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-07-20 03:26:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: more sql injection escapes...

Browse Source
This commit is contained in:
Martin Ambrus
2017-10-17 16:13:06 +02:00
parent 17fcadc3d1
commit 2b12f16b3d
7 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build.php
+2 -2
View File
@@ -236,12 +236,12 @@ $oldmovement=$database->getMovementById($_GET['moveid']);
$now=time();
if(($now-$oldmovement[0]['starttime'])<90 && $oldmovement[0]['from'] == $village->wid){
$qc="SELECT * FROM " . TB_PREFIX . "movement where proc = 0 and moveid = ".$_GET['moveid'];
$qc="SELECT * FROM " . TB_PREFIX . "movement where proc = 0 and moveid = ".$database->escape($_GET['moveid']);
$resultc=$database->query($qc) or die(mysqli_error($database->dblink));
if (mysqli_num_rows($resultc)==1){
$q = "UPDATE " . TB_PREFIX . "movement set proc = 1 where proc = 0 and moveid = ".$_GET['moveid'];
$q = "UPDATE " . TB_PREFIX . "movement set proc = 1 where proc = 0 and moveid = ".$database->escape($_GET['moveid']);
$database->query($q);
$end=$now+($now-$oldmovement[0]['starttime']);
//echo "6,".$oldmovement[0]['to'].",".$oldmovement[0]['from'].",0,".$now.",".$end;