Fix SQL injection in comments

Dovgalyuk · Aug 11, 2015 · e3aa4d0 · e3aa4d0
1 parent 5e51243
commit e3aa4d0
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/site/procedures.php b/site/procedures.php
@@ -1811,6 +1811,7 @@ function sendComments($newsId, $text)
 		{
 			$newsId 		= intval($newsId);
 			$currentUserId 	= intval(getActiveUserID());
+			$text = mysqli_real_escape_string($link, $text);
 			if ($currentUserId != -1)
 			{
 				$query = mysqli_query($link, "INSERT INTO newsComments SET news = $newsId, user = $currentUserId, text = '$text', date = NOW()");