diff options
| author | Andrew Dolgov <[email protected]> | 2009-10-19 23:29:45 +0400 |
|---|---|---|
| committer | Andrew Dolgov <[email protected]> | 2009-10-19 23:29:45 +0400 |
| commit | 7a13338b4c9ee0f421a9e182e83cb2d8f458774e (patch) | |
| tree | 204a926e32095a8dd5334beb4eb271d55d5d063b /modules/backend-rpc.php | |
| parent | 4e332844b4d546e939c54cbbdcff1a11840aa0e3 (diff) | |
fix proper escaping of label titles (closes #255)
Diffstat (limited to 'modules/backend-rpc.php')
| -rw-r--r-- | modules/backend-rpc.php | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/modules/backend-rpc.php b/modules/backend-rpc.php index 3e4a94340..1a65efc02 100644 --- a/modules/backend-rpc.php +++ b/modules/backend-rpc.php @@ -450,7 +450,8 @@ $ids = split(",", db_escape_string($_REQUEST["ids"])); $label_id = db_escape_string($_REQUEST["lid"]); - $label = label_find_caption($link, $label_id, $_SESSION["uid"]); + $label = db_escape_string(label_find_caption($link, $label_id, + $_SESSION["uid"])); print "<rpc-reply>"; print "<info-for-headlines>"; @@ -485,7 +486,8 @@ $ids = split(",", db_escape_string($_REQUEST["ids"])); $label_id = db_escape_string($_REQUEST["lid"]); - $label = label_find_caption($link, $label_id, $_SESSION["uid"]); + $label = db_escape_string(label_find_caption($link, $label_id, + $_SESSION["uid"])); print "<rpc-reply>"; |