Ticket #22: adminsettings_include_patch.diff

home/johnny/public_html/phpbms/modules/base/include/adminsettings_include.php

@@ -41 +41 @@
         global $dblink;
         
         foreach($settings as $key=>$value){
-                $querystatement="UPDATE settings set value=\"".$value."\" WHERE name=\"".$key."\"";
+                $querystatement="UPDATE settings set value=\"".addslashes($value)."\" WHERE name=\"".$key."\"";
                 $queryresult=mysql_query($querystatement,$dblink);
                 if(!$queryresult) reportError(mysql_error($dblink)." - ".$querystatement);              
         }