Webpages Version 1.6 module for PHPNuke 7.5 and up

registered · Regular Joined: Aug 15, 2006 Posts: 66

I'm wanting to use the Only registered users can see links on this board! Get registered or login! version 1.6 but, I'm finding that posting a webpage with an apostrophe difficult.

I've worked out that I have to add stripslashes etc but to be honest I'm not exactly sure what I need to look at to make it work. I've been reading some posts about stripslashes (here and elsewhere) and I'm still a wee bit confused (probably because me attention is being pulled off the page everytime I begin to digest by family). If anyone can give me a bit of a help it'd be a appreciated.

registered · Posted: Sat Sep 16, 2006 10:28 pm

Not stripslashes, but addslashes Smile

Posted: Mon Oct 09, 2006 4:20 am

So... I've attempted putting in addslashes but I'm not quite sure where its to go ... I tried it yesterday... by trial and error and ended up having to start again Razz

First I found this code on teh edit.php page

Code:

$webpage = FixQuotes($webpage);

Where I think I need to also add the addslashes line as well. The code for this would be:

Code:

$webpage = addslashes($webpage);

Which I've done... but now the published page is showing:

/''s rather than just the 's

So is this where the stripslashes comes in and it needs to be entered elsewhere?

Posted: Mon Oct 09, 2006 10:48 am

Alright, first let's just a few things..

What version are you using? Is it Patched?
- Is magic_quotes_gpc turned on? This is a PHP configuration you can get from phpinfo()
- Does the code use other functions besides addslashes? Specifically anything involving that variable and: stripslashes, FixQuotes, check_html, or filter

Posted: Tue Oct 10, 2006 4:06 pm

I have nuke 7.6 patched with sentinal 2.5.02.

Magic_quotes_gpc is turned on.

The only existing function that I found in the addon was FixQuotes - used once only. (see my post above).

Posted: Tue Oct 10, 2006 10:53 pm

Okay, can you find the SQL code for that insertion and post it here?

It should be a line that includes
INSERT INTO

Posted: Thu Oct 12, 2006 4:21 am

I think this is the code that you want. It uses only "insert".

Code:




function do_save_webpage($uid,$webpage,$showname,$fullpage,$format) {


  global $user_prefix, $dbi;





  if (isset($showname)) {


    $showname=1;


  } else {


    $showname=0;


  }





  if (isset($fullpage)) {


    $fullpage=1;


  } else {


    $fullpage=0;


  }





  switch($format) {


    default:


      $format=0;


      break;





    case "html":


      $format=1;


      break;





    case "extrans":


      $format=2;


      break;


  }








  $webpage = FixQuotes($webpage);


  $webpage = addslashes($webpage);


  $result=sql_query("select uid from ".$user_prefix."_webpages where uid=$uid", $dbi);


  if ( sql_num_rows($result,$dbi)==1) {


    sql_query("update ".$user_prefix."_webpages set webpage='$webpage',showname=$showname,"


             ."fullpage=$fullpage,format=$format where uid=$uid", $dbi);


  } else {


    sql_query("insert ".$user_prefix."_webpages (uid,webpage,showname,fullpage,format) "


             ."values ($uid,'$webpage',$showname,$fullpage,$format)", $dbi);


  }


}

Thanking for helping me.

Posted: Thu Oct 12, 2006 8:19 am

Here's the code change I recommend

Code:







FIND: 





  $webpage = FixQuotes($webpage);


  $webpage = addslashes($webpage);





REPLACE WITH





  $uid = intval($uid);


  $webpage = addslashes($webpage);

An additional check on $uid was added for security reasons

Posted: Fri Oct 13, 2006 10:25 pm

Thanks for that.

When I replaced that code, I still had the backslashes showing in the output. I worked out by trial and error though that all I needed to do was use the same code you gave me above, replace addslashes with stripslashes and put this at the top of the coding where the webpage was being called (function do_show_webpage).

Code:

$uid = intval($uid);


$webpage = stripslashes($webpage);

Its working fine now - thanks again for your help.

Posted: Fri Oct 13, 2006 11:26 pm

Sure, good luck with that code Smile