- sql injection

Fixed possible sql injection issue
XGProyect · Jan 28, 2016 · 4d18375 · 4d18375
1 parent b1f700f
commit 4d18375
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/2.10.9/upload/index.php b/src/2.10.9/upload/index.php
@@ -20,10 +20,12 @@
 switch ( ( isset ( $_GET['page'] ) ) )
 {
 	case'lostpassword':
-		function sendnewpassword($mail)
+		function sendnewpassword($_mail)
 		{
 			global $lang;
 
+                        $mail = mysql_real_escape_string($_mail);
+
 			$ExistMail = doquery("SELECT `email` FROM {{table}} WHERE `email` = '". $mail ."' LIMIT 1;", 'users', TRUE);
 
 			if (empty($ExistMail['email']))