Closed JakobStruye closed 10 years ago
Added dirty fix in f4a6e8a050427769713739d9adeea5bb091616a3
Laravel only provides prepared statements, no escaping. I just deleted the escaping line. I tried to do
"UPDATE user SET ? = ? WHERE id = ?, array($field, $value, $userID)
However this way Laravel could not tell if $value was supposed to be a string and would not quote it if needed.
I guess it's not a security risk the way we use it, as the user has no control over the $field variable.
Modified the function, passing the field name no longer needed (as suggested by Ruben). Also fixed some minor stuff on the Preferences page.
Whenever I try to change something in Preferences, I get the error that mysql_real_escape_string is deprecated. May be platform-dependent