| MaryTheG(r)eek |
01-27-2010 06:51 AM |
Quote:
Originally Posted by thincom2000
(Post 1967707)
missing $db->escape_string?
|
I don't think so, as this is just a few lines before. Actually the problem is why this email has been accepted. I also added this function in the cron, just for an additional security check, but the problem is before, during record's save.
I seen again the code, and seems to me correct:
Code:
$vbulletin->input->clean_array_gpc('p', array(
'subscriberid' => TYPE_INT,
'groupid' => TYPE_INT,
'email' => TYPE_STR
));
// Get Values
$subscriberid = $vbulletin->GPC['subscriberid'];
$groupid = $vbulletin->GPC['groupid'];
$email = $db->escape_string($vbulletin->GPC['email']);
if($subscriberid != 0)
{
if(is_valid_email($email))
{
$vbulletin->db->query_write("UPDATE " . TABLE_PREFIX . "micronewsletter_subscribers
SET groupid = '$groupid',
email = '$email' WHERE id=$subscriberid");
} else {
$vbulletin->url="newsletter.php?" . $vbulletin->session->vars['sessionurl'] . "do=main&tab=5";
eval(print_standard_redirect('micronewsletter_invalid_email', true, true));
}
} else {
if(is_valid_email($email))
{
First I'm escaping the string and then I'm checking for valid email address. The only that maybe is wrong, is if it needs something else than "TYPE_STR". Is there "TYPE_EMAIL" ??
Maria |
More Information