Forum Moderators: coopster
if(!$_POST['set_desc']){
print "<form method=\"post\">
<b>Post ID</b>:<br />
<input type=\"text\" name=\"pid\" size=\"15\" /><br />
<b>Youtube Url</b>:<br />
<input type=\"text\" name=\"url\" size=\"25\" /><br />
<b>Embed Url</b>:<br />
<input type=\"text\" name=\"embed\" size=\"25\" /><br />
<b>Description</b>:<br />
<textarea cols=\"50\" rows=\"5\" name=\"short_desc\" maxlength=\"120\"></textarea><br />
<input type=\"submit\" name=\"set_desc\" value=\"Set Description\">
</form> ";
}else{
$pid = (int) $_POST['pid'];
$short_desc = addslashes($_POST['short_desc']);
$url = addslashes($_POST['url']);
$embed = addslashes($_POST['embed']);
if(empty($pid) ¦¦ empty($short_desc) ¦¦ empty($embed)¦¦ empty($url)){
print "You left A Field Blank.!";
}else{
$update = mysql_query("UPDATE `phpbb_posts_text` SET `short_desc`,`youtube`,`embed` = '$short_desc','$url','$embed' WHERE `post_id` = '$pid';");
print "Good to go!";
}
}
?>
$short_desc = addslashes($_POST['short_desc']);
Should look like this:
$short_desc = [url=http://www.php.net/mysql-real-escape-string]mysql_real_escape_string[/url]($_POST['short_desc']);