From b19b0f5d728485a990fda8998a2cae2e32b96d75 Mon Sep 17 00:00:00 2001
From: pecesama <pecesama@gmail.com>
Date: Mon, 5 Nov 2007 23:00:57 +0000
Subject: [PATCH] Fix XSS security hole on comments

---
 classes/mysql_connection.class.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/classes/mysql_connection.class.php b/classes/mysql_connection.class.php
index 95a11c9..9759086 100644
--- a/classes/mysql_connection.class.php
+++ b/classes/mysql_connection.class.php
@@ -101,7 +101,9 @@ class Conexion_Mysql {
 	  
 	  foreach ($datos as $llave=>$valor) {
 		  
-		 $cols .= "$llave,";  
+		 $cols .= "$llave,"; 
+		 
+		 $valor = htmlspecialchars($valor,ENT_QUOTES);
 		 
 		 $tipo_col = $this->obtenerTipoCampo($tabla, $llave);  // obtiene el tipo de campo
 		 if (!$tipo_col) return false;  // error!
@@ -154,6 +156,8 @@ class Conexion_Mysql {
 		foreach ($datos as $llave=>$valor) {
 			$sql .= " $llave=";
 			
+			$valor = htmlspecialchars($valor,ENT_QUOTES);
+			
 			$tipo_col = $this->obtenerTipoCampo($tabla, $llave);  // obtiene el tipo de campo
 			if (!$tipo_col) return false;  // error!