Security statements update against sql injection attacks.

[fa-stable.git] / gl / includes / db / gl_db_currencies.inc

diff --git a/gl/includes/db/gl_db_currencies.inc b/gl/includes/db/gl_db_currencies.inc
index 0c386f8395bd9f923192e8cef9ade0b36dacaa4e..69b4e4a5cb938d99b2aa2a7413db18773a5bf0bc 100644 (file)
--- a/gl/includes/db/gl_db_currencies.inc
+++ b/gl/includes/db/gl_db_currencies.inc
@@ -13,8 +13,10 @@
 
 function update_currency($curr_abrev, $symbol, $currency, $country, $hundreds_name)
 {
-       $sql = "UPDATE ".TB_PREF."currencies SET currency=".db_escape($currency).", curr_symbol='$symbol',
-               country=".db_escape($country).", hundreds_name=".db_escape($hundreds_name)." WHERE curr_abrev = '$curr_abrev'";
+       $sql = "UPDATE ".TB_PREF."currencies SET currency="
+               .db_escape($currency).", curr_symbol=".db_escape($symbol).",
+               country=".db_escape($country).", hundreds_name=".db_escape($hundreds_name)
+               ." WHERE curr_abrev = ".db_escape($curr_abrev);
 
        db_query($sql, "could not update currency for $curr_abrev");
 }
@@ -24,7 +26,8 @@ function update_currency($curr_abrev, $symbol, $currency, $country, $hundreds_na
 function add_currency($curr_abrev, $symbol, $currency, $country, $hundreds_name)
 {
        $sql = "INSERT INTO ".TB_PREF."currencies (curr_abrev, curr_symbol, currency, country, hundreds_name)
-               VALUES (".db_escape($curr_abrev).", '$symbol', ".db_escape($currency).", ".db_escape($country).", ".db_escape($hundreds_name).")";
+               VALUES (".db_escape($curr_abrev).", ".db_escape($symbol).", "
+               .db_escape($currency).", ".db_escape($country).", ".db_escape($hundreds_name).")";
 
        db_query($sql, "could not add currency for $curr_abrev");
 }
@@ -33,7 +36,7 @@ function add_currency($curr_abrev, $symbol, $currency, $country, $hundreds_name)
 
 function delete_currency($curr_code)
 {
-       $sql="DELETE FROM ".TB_PREF."currencies WHERE curr_abrev='$curr_code'";
+       $sql="DELETE FROM ".TB_PREF."currencies WHERE curr_abrev=".db_escape($curr_code);
        db_query($sql, "could not delete currency       $curr_code");
 
        $sql="DELETE FROM ".TB_PREF."exchange_rates WHERE curr_code='$curr_code'";
@@ -44,7 +47,7 @@ function delete_currency($curr_code)
 
 function get_currency($curr_code)
 {
-       $sql = "SELECT * FROM ".TB_PREF."currencies WHERE curr_abrev='$curr_code'";
+       $sql = "SELECT * FROM ".TB_PREF."currencies WHERE curr_abrev=".db_escape($curr_code);
        $result = db_query($sql, "could not get currency $curr_code");
 
        $row = db_fetch($result);