bug #233

includes/account.php

@@ -2006,11 +2006,12 @@
 	{
 		$id = 43;
 		unset($oldid);
+		$lname = mysql_real_escape_string($_REQUEST['lname']);
 		$day = intval($_REQUEST['day']);
 		$month = intval($_REQUEST['month']);
 		$year = intval($_REQUEST['year']);
 		$userid = intval($_REQUEST['userid']);
-		$query = "update `users` set `dob`='$year-$month-$day' where `id`='$userid'";
+		$query = "update `users` set `lname`='$lname',`dob`='$year-$month-$day' where `id`='$userid'";
 		mysql_query($query);
 	}
 

pages/account/43.php

@@ -99,7 +99,11 @@
   </tr>
   <tr>
     <td class="DataTD"><?=_("Last Name")?>:</td>
-    <td class="DataTD"><?=$row['lname']?></td>
+    <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('Are you sure you want to modify this DOB and/or last name?')) return false;">
+	<input type="hidden" name="oldid" value="43">
+	<input type="hidden" name="action" value="updatedob">
+	<input type="hidden" name="userid" value="<?=$id?>">
+	<input type="text" name="lname" value="<?=$row['lname']?>"></td>
   </tr>
   <tr>
     <td class="DataTD"><?=_("Suffix")?>:</td>
@@ -107,10 +111,7 @@
   </tr>
   <tr>
     <td class="DataTD"><?=_("Date of Birth")?>:</td>
-    <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('Are you sure you want to modify this DOB?')) return false;">
-	<input type="hidden" name="oldid" value="43">
-	<input type="hidden" name="action" value="updatedob">
-	<input type="hidden" name="userid" value="<?=$id?>">
+    <td class="DataTD">
 <?
 	$year = intval(substr($row['dob'], 0, 4));
 	$month = intval(substr($row['dob'], 5, 2));