The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
|
#1
|
|||
|
|||
Having problems with clean_gpc function
I am using the following code...
Code:
function update_event($event) { global $vbulletin, $db; $venue = htmlspecialchars($vbulletin->input->clean_gpc('p', 'venue', TYPE_STR)); $name = htmlspecialchars($vbulletin->input->clean_gpc('p', 'name', TYPE_STR)); $split = htmlspecialchars($vbulletin->input->clean_gpc('p', 'split', TYPE_UINT)); $game = htmlspecialchars($vbulletin->input->clean_gpc('p', 'game', TYPE_UINT)); $category = htmlspecialchars($vbulletin->input->clean_gpc('p', 'category', TYPE_UINT)); $day = htmlspecialchars($vbulletin->input->clean_gpc('p', 'day', TYPE_UINT)); $month = htmlspecialchars($vbulletin->input->clean_gpc('p', 'month', TYPE_STR)); $year = htmlspecialchars($vbulletin->input->clean_gpc('p', 'year', TYPE_UINT)); $time = htmlspecialchars($vbulletin->input->clean_gpc('p', 'time', TYPE_STR)); $timestamp = $day." ".$month." ".$year." ".$time." ".date('T'); $db->query_write("UPDATE rank_events SET gameID='".$game."' WHERE eventID='".$event['eventID']."'"); $db->query_write("UPDATE rank_events SET categoryID='".$category."' WHERE eventID='".$event['eventID']."'"); $db->query_write("UPDATE rank_events SET eDate='".strtotime($timestamp)."' WHERE eventID='".$event['eventID']."'"); $db->query_write("UPDATE rank_events SET eVenue='".$venue."' WHERE eventID='".$event['eventID']."'"); $db->query_write("UPDATE rank_events SET eName='".$name."' WHERE eventID='".$event['eventID']."'"); $db->query_write("UPDATE rank_events SET eSplit='".$split."' WHERE eventID='".$event['eventID']."'"); } I thought this code would "sanitize" my inputs so that I wouldn't have any poisoning going on... but I still get the following error when I try to input something with a ' in it... Code:
Database error in vBulletin 3.8.1: Invalid SQL: UPDATE rank_events SET eVenue='Gamer's Edge' WHERE eventID='4'; MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Edge' WHERE eventID='4'' at line 1 Error Number : 1064 How do I fix this? |
Thread Tools | |
Display Modes | |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|