#1206 Escape

GetLuna · Apr 6, 2015 · 30b62a1 · 30b62a1
1 parent 9546552
commit 30b62a1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/backstage/menu.php b/backstage/menu.php
@@ -18,7 +18,7 @@
 	$item_name = luna_trim($_POST['name']);
 	$item_url = luna_trim($_POST['url']);
 
-	$db->query('INSERT INTO '.$db->prefix.'menu (url, name, disp_position, visible, sys_entry) VALUES(\''.$item_url.'\', \''.$item_name.'\', 0, 1, 0)') or error('Unable to add new menu item', __FILE__, __LINE__, $db->error());
+	$db->query('INSERT INTO '.$db->prefix.'menu (url, name, disp_position, visible, sys_entry) VALUES(\''.$db->escape($item_url).'\', \''.$db->escape($item_name).'\', 0, 1, 0)') or error('Unable to add new menu item', __FILE__, __LINE__, $db->error());
 
 	redirect('backstage/menu.php');
 } elseif (isset($_GET['del_item'])) {