Several fixes for template engine, JavaScripts, etc.

[mailer.git] / inc / libs / sponsor_functions.php

diff --git a/inc/libs/sponsor_functions.php b/inc/libs/sponsor_functions.php
index 630db06a0f31aaeebab04cca1b0c97c9e0459d8a..e1ee608916770ba0303e98025d3b187d3829016b 100644 (file)
--- a/inc/libs/sponsor_functions.php
+++ b/inc/libs/sponsor_functions.php
@@ -122,7 +122,7 @@ function handlSponsorRequest (&$postData, $update=false, $messageArray=array(),
                // Save sponsor?
                if ($SAVE === true) {
                        // Default is no force even when a guest want to abuse this force switch
-                       if ((empty($postData['force'])) || (!isAdmin())) $postData['force'] = 0;
+                       if ((empty($postData['force'])) || (!isAdmin())) $postData['force'] = '0';
 
                        // SQL and message string is empty by default
                        $sql = ''; $message = '';
@@ -142,7 +142,7 @@ function handlSponsorRequest (&$postData, $update=false, $messageArray=array(),
                                // Generate message
                                $message = getMessageFromIndexedArray(getMessage('ADMIN_SPONSOR_UPDATED'), 'updated', $messageArray);
                                $ret = "updated";
-                       } elseif (($ALREADY === false) || (($postData['force'] == '1') && (isAdmin()))) {
+                       } elseif (($ALREADY === false) || (($postData['force'] == 1) && (isAdmin()))) {
                                // Add new sponsor, first add more data
                                $DATA['keys'][] = 'sponsor_created'; $DATA['values'][] = time();
                                $DATA['keys'][] = 'status';
@@ -175,10 +175,12 @@ function handlSponsorRequest (&$postData, $update=false, $messageArray=array(),
                                $OUT = '';
                                foreach ($postData as $k => $v) {
                                        // Do not add 'force' !
-                                       if ($k != "force") {
-                                               $OUT .= "<input type=\"hidden\" name=\"".$k."\" value=\"".stripslashes($v)."\" />\n";
-                                       }
-                               }
+                                       if ($k != 'force') {
+                                               $OUT .= "<input type=\"hidden\" name=\"" . SQL_ESCAPE($k) . "\" value=\"" . SQL_ESCAPE($v) . "\" />\n";
+                                       } // END - if
+                               } // END - foreach
+
+                               // Remember data
                                $content['hidden'] = $OUT;
                                $content['email']  = $postData['email'];