Fixed SQL injection (thanks to Sijmen Ruwhof).

xdebug · Apr 15, 2012 · 2978ad4 · 2978ad4
1 parent a9f9c30
commit 2978ad4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/html/include/header.php b/html/include/header.php
@@ -98,7 +98,7 @@ function hits ($key)
 	function refer ()
 	{
 		if (isset ($_SERVER["HTTP_REFERER"]) && !empty ($_SERVER["HTTP_REFERER"])) {
-			$ref = $_SERVER["HTTP_REFERER"];
+			$ref = mysql_real_escape_string( $_SERVER["HTTP_REFERER"] );
 
 			$res = @mysql_query ("SELECT * FROM refer WHERE refer = '$ref'");
 			if (@mysql_num_rows ($res) == 0) {