X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=includes%2Fdb%2Fconnect_db_mysql.inc;h=8abdaa34f268e4cce6b934213abf645f6c0426ad;hb=5d023098e6b5a31416949f00c66ffa28ed3cb589;hp=d3857cabb945a5517dd9d779e82a99a4c60ce659;hpb=7f32bbd73c782449684cf6c6bf987e5bfbae9eb7;p=fa-stable.git

diff --git a/includes/db/connect_db_mysql.inc b/includes/db/connect_db_mysql.inc
index d3857cab..8abdaa34 100644
--- a/includes/db/connect_db_mysql.inc
+++ b/includes/db/connect_db_mysql.inc
@@ -10,7 +10,7 @@
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 define('DB_DUPLICATE_ERROR', 1062);
-define('SQL_MODE', ''); // STRICT_ALL_TABLES,NO_ZERO_IN_DATE ?
+define('SQL_MODE', 'STRICT_ALL_TABLES'); // prevents SQL injection with silent field content truncation
 
 function set_global_connection($company=-1)
 {
@@ -51,7 +51,7 @@ function db_query($sql, $err_msg=null)
 
 	// set current db prefix
 	$comp = isset($_SESSION["wa_current_user"]->cur_con) ? $_SESSION["wa_current_user"]->cur_con : 0;
-	$cur_prefix = $db_connections[$comp]['tbpref'];
+	$cur_prefix = @$db_connections[$comp]['tbpref'];
 	$sql = str_replace(TB_PREF, $cur_prefix, $sql);
 
 	if ($SysPrefs->show_sql)