bug #183

includes/general.php

@@ -339,6 +339,7 @@
 				else
 					$dom = $bits[$i];
 				$_SESSION['_config']['row'] = "";
+				$dom = mysql_real_escape_string($dom);
 				$query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
 				$res = mysql_query($query);
 				if(mysql_num_rows($res) > 0)
@@ -390,6 +391,7 @@
 				else
 					$dom = $bits[$i];
 				$_SESSION['_config']['altrow'] = "";
+				$dom = mysql_real_escape_string($dom);
 				$query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
 				$res = mysql_query($query);
 				if(mysql_num_rows($res) > 0)
@@ -425,6 +427,7 @@
 				else
 					$dom = $bits[$i];
 				$_SESSION['_config']['row'] = "";
+				$dom = mysql_real_escape_string($dom);
 				$query = "select *, `orginfo`.`id` as `id` from `orginfo`,`orgdomains`,`org` where
 						`org`.`memid`='".$_SESSION['profile']['id']."' and
 						`org`.`orgid`=`orginfo`.`id` and
@@ -472,6 +475,7 @@
 				else
 					$dom = $bits[$i];
 				$_SESSION['_config']['altrow'] = "";
+				$dom = mysql_real_escape_string($dom);
 				$query = "select * from `orginfo`,`orgdomains`,`org` where
 						`org`.`memid`='".$_SESSION['profile']['id']."' and
 						`org`.`orgid`=`orginfo`.`id` and
@@ -503,6 +507,7 @@
 				$dom = $bits[$i].".".$dom;
 			else
 				$dom = $bits[$i];
+			$dom = mysql_real_escape_string($dom);
 			$query = "select * from `org`,`orgdomains`,`orginfo`
 					where `org`.`memid`='".$_SESSION['profile']['id']."'
 					and `orgdomains`.`orgid`=`org`.`orgid`