OK, I found the bug with the ' problem. There was also a big problem with some html code when adding a new article, and when editing.
When adding new, I would not pass some of the html code, and when editing, it would not update. This only happened when using certain html code.
Two php commands:
addslashes() and htmlspecialchars() were not used correctly with the intent of this hack. I noticed the same thing in the vbLink hack as well (which this was based off of).
cinq,
I have corrected the html code issue as far as I know (This hack is working for me curently without flaws. Also, being able to post html code of user forms is a big security risk. I would suggest that everyone either turn on validation (so you can check the code before approving it), although I think it's safe this way, I'm not positive or to disable user submitions all together. I'm disabling it on my site all together. I'd rather have users email me an html file (that I can check locally) before posting it on my site for security reasons.
Not trying to step on any toes or anything, but I like this hack, and want to use it as quickly as possible, so I figured I help you out by posting my findings.
I'm attaching an updated vbArticlesadmin.php below.
|