diff --git a/include/application.php b/include/application.php
index ff66bca..bf6fa47 100644
--- a/include/application.php
+++ b/include/application.php
@@ -450,10 +450,7 @@ class Application {
echo '
| Application description | ',"\n";
echo ' |
',"\n";
- else
- echo $this->sDescription.'',"\n";
+ echo $this->sDescription.'',"\n";
echo "\n";
@@ -505,25 +502,13 @@ class Application {
$aClean['appWebpage'] = makeSafe($_REQUEST['appWebpage']);
$aClean['appKeywords'] = makeSafe($_REQUEST['appKeywords']);
- if(get_magic_quotes_gpc())
- {
- $this->iAppId = stripslashes($aClean['appId']);
- $this->sName = stripslashes($aClean['appName']);
- $this->sDescription = stripslashes($aClean['appDescription']);
- $this->iCatId = stripslashes($aClean['appCatId']);
- $this->iVendorId = stripslashes($aClean['appVendorId']);
- $this->sWebpage = stripslashes($aClean['appWebpage']);
- $this->sKeywords = stripslashes($aClean['appKeywords']);
- } else
- {
- $this->iAppId = $aClean['appId'];
- $this->sName = $aClean['appName'];
- $this->sDescription = $aClean['appDescription'];
- $this->iCatId = $aClean['appCatId'];
- $this->iVendorId = $aClean['appVendorId'];
- $this->sWebpage = $aClean['appWebpage'];
- $this->sKeywords = $aClean['appKeywords'];
- }
+ $this->iAppId = $aClean['appId'];
+ $this->sName = $aClean['appName'];
+ $this->sDescription = $aClean['appDescription'];
+ $this->iCatId = $aClean['appCatId'];
+ $this->iVendorId = $aClean['appVendorId'];
+ $this->sWebpage = $aClean['appWebpage'];
+ $this->sKeywords = $aClean['appKeywords'];
}
/* display this application */
diff --git a/include/distributions.php b/include/distributions.php
index cb4fdc7..4cd073a 100644
--- a/include/distributions.php
+++ b/include/distributions.php
@@ -367,17 +367,9 @@ class distribution{
$aClean['sName'] = makeSafe($_REQUEST['sName']);
$aClean['sUrl'] = makeSafe($_REQUEST['sUrl']);
- if(get_magic_quotes_gpc())
- {
- $this->iDistributionId = stripslashes($aClean['iDistributionId']);
- $this->sName = stripslashes($aClean['sName']);
- $this->sUrl = stripslashes($aClean['sUrl']);
- } else
- {
- $this->iDistributionId = $aClean['iDistributionId'];
- $this->sName = $aClean['sName'];
- $this->sUrl = $aClean['sUrl'];
- }
+ $this->iDistributionId = $aClean['iDistributionId'];
+ $this->sName = $aClean['sName'];
+ $this->sUrl = $aClean['sUrl'];
}
}
diff --git a/include/incl.php b/include/incl.php
index f4a7ebf..afa3639 100644
--- a/include/incl.php
+++ b/include/incl.php
@@ -13,6 +13,27 @@ require(BASE."include/menu.php");
require(BASE."include/html.php");
require(BASE."include/db.php");
+/* if magic quotes are enabled make sure the user disables them */
+/* otherwise they will see all kinds of odd effects that are difficult */
+/* to track down */
+if(get_magic_quotes_gpc())
+{
+ echo "Please disable the magic quotes GPC PHP setting. See this page for more information
";
+ echo "AppDB php code assumes magic quotes are disabled.
";
+ echo "Magic quotes are a bad idea for a few reasons.
";
+ echo "First is that php calls addslashes() on all \$_POST, \$_REQUEST and cookie variables ";
+ echo "if magic quotes is enabled. ";
+ echo "Ooooooh you say.
";
+ echo "\"Aren't magic quotes a convienent way to protect my php code from sql injection attacks?\"
";
+ echo "No! addslashes() isn't adequate. You should use mysql_real_escape_string() or some other function";
+ echo " that will handle multi-byte characters. See this article";
+ echo " for a way to exploit addslash()ed parameters.
";
+ echo "A second reason is that with magic quotes enabled, due to the use of mysql_real_escape_string() to";
+ echo " protect from sql injection attacks we'll end up with variables that have been addslash()ed and";
+ echo " mysql_real_escape_string()ed. So you end up having to call stripslashes() on EVERY variable. ";
+ exit;
+}
+
// create arrays
$sidebar_func_list = array();
$help_list = array();
diff --git a/include/testResults.php b/include/testResults.php
index dc1bfd2..b782e3a 100644
--- a/include/testResults.php
+++ b/include/testResults.php
@@ -574,35 +574,18 @@ class testData{
$aClean['sTestedRating'] = makeSafe($_REQUEST['sTestedRating']);
$aClean['sComments'] = makeSafe($_REQUEST['sComments']);
- if(get_magic_quotes_gpc())
- {
- $this->iTestingId = stripslashes($aClean['iTestingId']);
- $this->iVersionId = stripslashes($aClean['iVersionId']);
- $this->sWhatWorks = stripslashes($aClean['sWhatWorks']);
- $this->sWhatDoesnt = stripslashes($aClean['sWhatDoesnt']);
- $this->sWhatNotTested = stripslashes($aClean['sWhatNotTested']);
- $this->sTestedDate = stripslashes($aClean['sTestedDate']);
- $this->iDistributionId = stripslashes($aClean['iDistributionId']);
- $this->sTestedRelease = stripslashes($aClean['sTestedRelease']);
- $this->sInstalls = stripslashes($aClean['sInstalls']);
- $this->sRuns = stripslashes($aClean['sRuns']);
- $this->sTestedRating = stripslashes($aClean['sTestedRating']);
- $this->sComments = stripslashes($aClean['sComments']);
- } else
- {
- $this->iTestingId = $aClean['iTestingId'];
- $this->iVersionId = $aClean['iVersionId'];
- $this->sWhatWorks = $aClean['sWhatWorks'];
- $this->sWhatDoesnt = $aClean['sWhatDoesnt'];
- $this->sWhatNotTested = $aClean['sWhatNotTested'];
- $this->sTestedDate = $aClean['sTestedDate'];
- $this->iDistributionId = $aClean['iDistributionId'];
- $this->sTestedRelease = $aClean['sTestedRelease'];
- $this->sInstalls = $aClean['sInstalls'];
- $this->sRuns = $aClean['sRuns'];
- $this->sTestedRating = $aClean['sTestedRating'];
- $this->sComments = $aClean['sComments'];
- }
+ $this->iTestingId = $aClean['iTestingId'];
+ $this->iVersionId = $aClean['iVersionId'];
+ $this->sWhatWorks = $aClean['sWhatWorks'];
+ $this->sWhatDoesnt = $aClean['sWhatDoesnt'];
+ $this->sWhatNotTested = $aClean['sWhatNotTested'];
+ $this->sTestedDate = $aClean['sTestedDate'];
+ $this->iDistributionId = $aClean['iDistributionId'];
+ $this->sTestedRelease = $aClean['sTestedRelease'];
+ $this->sInstalls = $aClean['sInstalls'];
+ $this->sRuns = $aClean['sRuns'];
+ $this->sTestedRating = $aClean['sTestedRating'];
+ $this->sComments = $aClean['sComments'];
}
diff --git a/include/version.php b/include/version.php
index 30bf6bc..9a31a00 100644
--- a/include/version.php
+++ b/include/version.php
@@ -552,13 +552,7 @@ class Version {
echo '| Version description | ',"\n";
echo ' |
',"\n";
- else
- echo $this->sDescription.'',"\n";
+ echo $this->sDescription.'',"\n";
echo '',"\n";
@@ -612,23 +606,12 @@ class Version {
$aClean['maintainer_rating'] = makeSafe($_REQUEST['maintainer_rating']);
$aClean['maintainer_release'] = makeSafe($_REQUEST['maintainer_release']);
- if(get_magic_quotes_gpc())
- {
- $this->iAppId = stripslashes($aClean['appId']);
- $this->iVersionId = stripslashes($aClean['versionId']);
- $this->sName = stripslashes($aClean['versionName']);
- $this->sDescription = stripslashes($aClean['versionDescription']);
- $this->sTestedRating = stripslashes($aClean['maintainer_rating']);
- $this->sTestedRelease = stripslashes($aClean['maintainer_release']);
- } else
- {
- $this->iAppId = $aClean['appId'];
- $this->iVersionId = $aClean['versionId'];
- $this->sName = $aClean['versionName'];
- $this->sDescription = $aClean['versionDescription'];
- $this->sTestedRating = $aClean['maintainer_rating'];
- $this->sTestedRelease = $aClean['maintainer_release'];
- }
+ $this->iAppId = $aClean['appId'];
+ $this->iVersionId = $aClean['versionId'];
+ $this->sName = $aClean['versionName'];
+ $this->sDescription = $aClean['versionDescription'];
+ $this->sTestedRating = $aClean['maintainer_rating'];
+ $this->sTestedRelease = $aClean['maintainer_release'];
}
function display()