From 2a4b4a328fc273bf6157e9173d9596c92597d349 Mon Sep 17 00:00:00 2001
From: eirik <eirik@srv.vert.no>
Date: Mon, 1 Feb 2010 19:07:04 +0100
Subject: [PATCH] Some security fixes.

---
 inside/ajax.php      | 8 ++++----
 inside/checkZip.php  | 2 +-
 inside/functions.php | 2 +-
 inside/pos.php       | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/inside/ajax.php b/inside/ajax.php
index 85ddf96..2d2a973 100644
--- a/inside/ajax.php
+++ b/inside/ajax.php
@@ -7,10 +7,10 @@ print('<?xml version="1.0" encoding="ISO-8859-1"?'.'>');
    
 $conn = db_connect();
 
-$action = $_REQUEST['action'];
+$action = mysql_real_escape_string($_REQUEST['action']);
 if ($action == 'checkZip'){
 
-  $zip = $_REQUEST['zip']; 
+  $zip = mysql_real_escape_string($_REQUEST['zip']); 
   if ($zip != "") {  	
     $sql = "SELECT poststed AS postarea
            FROM din_postnummer
@@ -72,7 +72,7 @@ if ($action == 'checkZip'){
   printRemoveCatXML($type);
 
 }else if ($action == 'checkUsername') {
-  $username = $_REQUEST['username'];
+  $username = mysql_real_escape_string($_REQUEST['username']);
   $conn = db_connect("forum");
   $sql = sprintf("SELECT user_id FROM phpbb_users u "."WHERE username_clean = '%s' ", strtolower($username));
   $result = & $conn->query($sql);
@@ -114,4 +114,4 @@ function printRemoveCatXML($type){
 <?php
 
 }
-?>
\ No newline at end of file
+?>
diff --git a/inside/checkZip.php b/inside/checkZip.php
index 85a0d99..0af01ee 100644
--- a/inside/checkZip.php
+++ b/inside/checkZip.php
@@ -7,7 +7,7 @@ header("Content-type: application/xml");
    
   $conn = db_connect();
 
-  $zip = $_REQUEST['zip']; 
+  $zip = mysql_real_escape_string($_REQUEST['zip']); 
 
   $sql = "SELECT poststed AS postarea
           FROM din_postnummer
diff --git a/inside/functions.php b/inside/functions.php
index 761dee2..1d5297e 100644
--- a/inside/functions.php
+++ b/inside/functions.php
@@ -69,7 +69,7 @@ function scriptParam($name) {
 	}
 	else
 		if (isset ($_POST[$name])) {
-			$val = $_POST[$name];
+			$val = mysql_real_escape_string($_POST[$name]);
 		}
 		else
 			if (isset ($_GET[$name])) {
diff --git a/inside/pos.php b/inside/pos.php
index 9d3b0f5..5777f83 100644
--- a/inside/pos.php
+++ b/inside/pos.php
@@ -8,7 +8,7 @@ header("Content-type: application/xml");
    
   $conn = db_connect();
 
-  $posId = $_REQUEST['positionid']; 
+  $posId = mysql_real_escape_string($_REQUEST['positionid']); 
 
   $sql = "SELECT name, text
           FROM din_position