Browse Source

Limit title length

spaghetti 7 years ago
parent
commit
a8ff5bf577
1 changed files with 7 additions and 5 deletions
  1. 7
    5
      sections/store/title.php

+ 7
- 5
sections/store/title.php View File

1
 <?
1
 <?
2
 if (isset($_POST['title'])) {
2
 if (isset($_POST['title'])) {
3
 
3
 
4
+  if (strlen($_POST['title']) > 30) error("Title too long");
5
+
4
   $Title = htmlspecialchars($_POST['title'], ENT_QUOTES);
6
   $Title = htmlspecialchars($_POST['title'], ENT_QUOTES);
5
 
7
 
6
   $UserID = $LoggedUser['ID'];
8
   $UserID = $LoggedUser['ID'];
17
       $DB->query("
19
       $DB->query("
18
         UPDATE users_main
20
         UPDATE users_main
19
         SET BonusPoints = BonusPoints - 50000,
21
         SET BonusPoints = BonusPoints - 50000,
20
-            Title       = '$Title'
21
-        WHERE ID = $UserID");
22
+            Title = ?
23
+        WHERE ID = ?", $Title, $UserID);
22
       $DB->query("
24
       $DB->query("
23
         UPDATE users_info
25
         UPDATE users_info
24
-        SET AdminComment = CONCAT('".sqltime()." - Changed title to $Title via the store\n\n', AdminComment)
25
-        WHERE UserID = $UserID");
26
+        SET AdminComment = CONCAT(NOW(), ' - Changed title to ', ?, ' via the store\n\n', AdminComment)
27
+        WHERE UserID = ?", $Title, $UserID);
26
       $Cache->delete_value('user_info_'.$UserID);
28
       $Cache->delete_value('user_info_'.$UserID);
27
       $Cache->delete_value('user_info_heavy_'.$UserID);
29
       $Cache->delete_value('user_info_heavy_'.$UserID);
28
 
30
 
52
           Enter the title you want
54
           Enter the title you want
53
         </strong>
55
         </strong>
54
         <br>
56
         <br>
55
-        <input type="text" name="title" value="">
57
+        <input type="text" name="title" maxlength="30" value="">
56
         <input type="submit">
58
         <input type="submit">
57
       </form>
59
       </form>
58
       <p><a href="/store.php">Back to Store</a></p>
60
       <p><a href="/store.php">Back to Store</a></p>

Loading…
Cancel
Save