diff --git a/29/01.php b/29/01.php index 0faf497..5abd44d 100644 --- a/29/01.php +++ b/29/01.php @@ -46,16 +46,21 @@ function sanitizeString($var) { global $pdo; + $var = strip_tags($var); $var = htmlentities($var); + if (get_magic_quotes_gpc()) $var = stripslashes($var); + $result = $pdo->quote($var); // This adds single quotes return str_replace("'", "", $result); // So now remove them } function showProfile($user) { + global $pdo; + if (file_exists("$user.jpg")) echo ""; diff --git a/29/10.php b/29/10.php index 5d608d2..28f086c 100644 --- a/29/10.php +++ b/29/10.php @@ -27,16 +27,20 @@ $result = queryMysql("SELECT * FROM friends WHERE user='$view'"); + $j = 0; + while ($row = $result->fetch()) { - $followers[$j] = $row['friend']; + $followers[$j++] = $row['friend']; } $result = queryMysql("SELECT * FROM friends WHERE friend='$view'"); + $j = 0; + while ($row = $result->fetch()) { - $following[$j] = $row['user']; + $following[$j++] = $row['user']; } $mutual = array_intersect($followers, $following); diff --git a/29/11.php b/29/11.php index be8543f..6ff4228 100644 --- a/29/11.php +++ b/29/11.php @@ -55,6 +55,7 @@ _END; $query = "SELECT * FROM messages WHERE recip='$view' ORDER BY time DESC"; $result = queryMysql($query); + $num = $result->rowCount(); while ($row = $result->fetch()) { diff --git a/robinsnest/friends.php b/robinsnest/friends.php index 5d608d2..92b2fad 100644 --- a/robinsnest/friends.php +++ b/robinsnest/friends.php @@ -27,16 +27,20 @@ $result = queryMysql("SELECT * FROM friends WHERE user='$view'"); + $j = 0; + while ($row = $result->fetch()) { - $followers[$j] = $row['friend']; + $followers[$j+] = $row['friend']; } $result = queryMysql("SELECT * FROM friends WHERE friend='$view'"); + $j = 0; + while ($row = $result->fetch()) { - $following[$j] = $row['user']; + $following[$j++] = $row['user']; } $mutual = array_intersect($followers, $following); diff --git a/robinsnest/functions.php b/robinsnest/functions.php index 0faf497..5abd44d 100644 --- a/robinsnest/functions.php +++ b/robinsnest/functions.php @@ -46,16 +46,21 @@ function sanitizeString($var) { global $pdo; + $var = strip_tags($var); $var = htmlentities($var); + if (get_magic_quotes_gpc()) $var = stripslashes($var); + $result = $pdo->quote($var); // This adds single quotes return str_replace("'", "", $result); // So now remove them } function showProfile($user) { + global $pdo; + if (file_exists("$user.jpg")) echo ""; diff --git a/robinsnest/messages.php b/robinsnest/messages.php index be8543f..6ff4228 100644 --- a/robinsnest/messages.php +++ b/robinsnest/messages.php @@ -55,6 +55,7 @@ _END; $query = "SELECT * FROM messages WHERE recip='$view' ORDER BY time DESC"; $result = queryMysql($query); + $num = $result->rowCount(); while ($row = $result->fetch()) {