Show
Ignore:
Timestamp:
01/02/07 16:21:27 (23 months ago)
Author:
mbonetti
Message:

Probably a btter fix for #150

Files:
1 modified

Legend:

Unmodified
Added
Removed

  • trunk/gregarius/feed.php

    r1648 r1649  
    6666        $sql .=" and not(mode & " . RSS_MODE_PRIVATE_STATE .") "; 
    6767    } 
     68 
    6869    // don't hide deprecated items becuase we want items of deprecated feeds to be accessible 
    6970    // $sql .= " and not(mode & " . RSS_MODE_DELETED_STATE . ") "; 
    … …  
    141142    $iid = ""; 
    142143    if ($cid != "" && array_key_exists('iid',$_REQUEST) && $_REQUEST['iid'] != "") { 
    143         $sqlid =  preg_replace("/[^A-Za-z0-9\.]/","%",$_REQUEST['iid']); 
     144        $sqlid =  preg_replace("/[_';]/","%",sanitize($_REQUEST['iid'],RSS_SANITIZER_SIMPLE_SQL|RSS_SANITIZER_NO_SPACES)); 
    144145        $sql = "select id from " .getTable("item") ." i where i.title like '$sqlid' and i.cid=$cid"; 
    145146        if ($m > 0 && $y > 0) {