rubenvanassche / Programming-Project-Databases

A World championship statistics website
coachcenter.be
GNU General Public License v3.0
1 stars 1 forks source link

Changing user information in preferences crashes #80

Closed JakobStruye closed 10 years ago

JakobStruye commented 10 years ago

Whenever I try to change something in Preferences, I get the error that mysql_real_escape_string is deprecated. May be platform-dependent

JakobStruye commented 10 years ago

Added dirty fix in f4a6e8a050427769713739d9adeea5bb091616a3

Laravel only provides prepared statements, no escaping. I just deleted the escaping line. I tried to do

"UPDATE user SET ? = ? WHERE id = ?, array($field, $value, $userID)

However this way Laravel could not tell if $value was supposed to be a string and would not quote it if needed.

I guess it's not a security risk the way we use it, as the user has no control over the $field variable.

JakobStruye commented 10 years ago

Modified the function, passing the field name no longer needed (as suggested by Ruben). Also fixed some minor stuff on the Preferences page.