X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fguest%2Fwhat-register.php;h=59ffc72e760046b2cddf5d194575dcf238e4fba4;hp=e0e3ca9b3e648fe3fab785df4e4d5d544f7170b6;hb=180646e7ce31e2772267540bb813f4798fc88c06;hpb=5ef6ed7373ae85e5635e39e2a0adf9496a8add05

diff --git a/inc/modules/guest/what-register.php b/inc/modules/guest/what-register.php
index e0e3ca9b3e..59ffc72e76 100644
--- a/inc/modules/guest/what-register.php
+++ b/inc/modules/guest/what-register.php
@@ -51,7 +51,7 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))
 ADD_DESCR("guest", basename(__FILE__));
 
 OPEN_TABLE("100%", "guest_content_align", "");
-global $CONFIG, $DATA;
+global $_CONFIG, $DATA;
 
 // Initialize variables
 $FAILED = false; $SHORT_PASS = false; $cats = 0; $IP_TIMEOUT = false;
@@ -122,7 +122,7 @@ if (isset($_POST['ok']))
 		$FAILED = true;
 	}
 	// Is the password long enouth?
-	if ((strlen($_POST['pass1']) < $CONFIG['pass_len']) && (!$FAILED) && (!IS_ADMIN()))
+	if ((strlen($_POST['pass1']) < $_CONFIG['pass_len']) && (!$FAILED) && (!IS_ADMIN()))
 	{
 		$SHORT_PASS = true;
 		$FAILED = true;
@@ -135,13 +135,13 @@ if (isset($_POST['ok']))
 		{
 			if ($answer == 'Y') $cats++;
 		}
-		if ($cats < $CONFIG['least_cats'])
+		if ($cats < $_CONFIG['least_cats'])
 		{
 			// ... nope!
 			$FAILED = true;
 		}
 	}
-	if (($_POST['addy'] != "!") && ($CONFIG['check_double_email'] == 'Y') && (!IS_ADMIN()))
+	if (($_POST['addy'] != "!") && ($_CONFIG['check_double_email'] == 'Y') && (!IS_ADMIN()))
 	{
 		// Does the email address already exists in our database?
 		$CHK = SEARCH_EMAIL_USERTAB($_POST['addy']);
@@ -149,7 +149,7 @@ if (isset($_POST['ok']))
 	}
 
 	// Check his IP number
-	$to = bigintval(time() - $CONFIG['ip_timeout']);
+	$to = bigintval(time() - $_CONFIG['ip_timeout']);
 	$result = SQL_QUERY_ESC("SELECT joined, last_update FROM "._MYSQL_PREFIX."_user_data WHERE REMOTE_ADDR='%s' AND (joined > %s OR last_update > %s) LIMIT 1",
 	 array(getenv('REMOTE_ADDR'), $to, $to), __FILE__, __LINE__);
 	if ((SQL_NUMROWS($result) == 1) && (!IS_ADMIN()))
@@ -166,8 +166,8 @@ if (isset($_POST['ok']))
 	if (SQL_NUMROWS($result) == 0)
 	{
 		// Not found so we set your refid!
-		$_POST['refid'] = $CONFIG['def_refid'];
-		@setcookie("refid", $CONFIG['def_refid'], (time() + $CONFIG['online_timeout']), COOKIE_PATH);
+		$_POST['refid'] = $_CONFIG['def_refid'];
+		set_session("refid", $_CONFIG['def_refid']);
 	}
 
 	// Free memory
@@ -198,7 +198,7 @@ if ((isset($_POST['ok'])) && (!$FAILED))
 	if (GET_EXT_VERSION("beg") >= "0.1.7")
 	{
 		// Okay, shall I disable now?
-		if ($CONFIG['beg_new_mem_notify'] == 'N')
+		if ($_CONFIG['beg_new_mem_notify'] == 'N')
 		{
 			$ADD1 .= ", beg_ral_notify, beg_ral_en_notify";
 			$ADD2 .= ", UNIX_TIMESTAMP(), UNIX_TIMESTAMP()";
@@ -209,7 +209,7 @@ if ((isset($_POST['ok'])) && (!$FAILED))
 	if (GET_EXT_VERSION("bonus") >= "0.7.7")
 	{
 		// Okay, shall I disable now?
-		if ($CONFIG['bonus_new_mem_notify'] == 'N')
+		if ($_CONFIG['bonus_new_mem_notify'] == 'N')
 		{
 			$ADD1 .= ", bonus_ral_notify, bonus_ral_en_notify";
 			$ADD2 .= ", UNIX_TIMESTAMP(), UNIX_TIMESTAMP()";
@@ -272,14 +272,14 @@ array(
 	{
 		// Add only when the line was not found (maybe some more secure?)
 		$locked = "points";
-		if ($CONFIG['ref_payout'] > 0) $locked = "locked_points"; // Pay him later. First he has to confirm some mails!
+		if ($_CONFIG['ref_payout'] > 0) $locked = "locked_points"; // Pay him later. First he has to confirm some mails!
 		$result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_user_points (userid, ref_depth, ".$locked.") VALUES(%d, 0, '%s')",
-		 array(bigintval($userid), $CONFIG['points_register']), __FILE__, __LINE__);
+		 array(bigintval($userid), $_CONFIG['points_register']), __FILE__, __LINE__);
 
 		// Update mediadata as well
 		if ((GET_EXT_VERSION("mediadata") >= "0.0.4") && ($locked == "points")) {
 			// Update database
-			MEDIA_UPDATE_ENTRY(array("total_points"), "add", $CONFIG['points_register']);
+			MEDIA_UPDATE_ENTRY(array("total_points"), "add", $_CONFIG['points_register']);
 		}
 	}
 
@@ -306,26 +306,26 @@ array(
 		'hash'    => $hash,
 		'uid'     => $userid,
 		'salut'   => $sex,
-		'surname' => $_POST['surname'],
-		'family'  => $_POST['family_name'],
-		'email'   => $_POST['addy'],
-		'street'  => $_POST['street_nr'],
-		'city'    => $_POST['city'],
+		'surname' => SQL_ESCAPE($_POST['surname']),
+		'family'  => SQL_ESCAPE($_POST['family_name']),
+		'email'   => SQL_ESCAPE($_POST['addy']),
+		'street'  => SQL_ESCAPE($_POST['street_nr']),
+		'city'    => SQL_ESCAPE($_POST['city']),
 		'zip'     => bigintval($_POST['zip']),
 		'country' => $countryData,
-		'refid'   => $_POST['refid'],
-		'pass'    => $_POST['pass1'],
+		'refid'   => SQL_ESCAPE($_POST['refid']),
+		'pass'    => SQL_ESCAPE($_POST['pass1']),
 	);
 
 	// Continue with birthday...
 	switch (GET_LANGUAGE())
 	{
 	case "de":
-		$DATA['birthday'] = $_POST['day'].".".$_POST['month'].".".$_POST['year'];
+		$DATA['birthday'] = bigintval($_POST['day']).".".bigintval($_POST['month']).".".bigintval($_POST['year']);
 		break;
 
 	default:
-		$DATA['birthday'] = $_POST['month']."/".$_POST['day']."/".$_POST['year'];
+		$DATA['birthday'] = bigintval($_POST['month'])."/".bigintval($_POST['day'])."/".bigintval($_POST['year']);
 		break;
 	}
 
@@ -357,51 +357,51 @@ array(
 {
 	if ($_POST['agree'] == "!")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".HAVE_TO_AGREE."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".HAVE_TO_AGREE."</SPAN></STRONG><br /><br />");
 	}
 	if ($_POST['addy'] == "!")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_EMAIL."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_EMAIL."</SPAN></STRONG><br /><br />");
 		$_POST['addy'] = "";
 	}
 	 elseif ($_POST['addy'] == "?")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".EMAIL_ALREADY_DB."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".EMAIL_ALREADY_DB."</SPAN></STRONG><br /><br />");
 		$_POST['addy'] = "";
 	}
 	if ($_POST['surname'] == "!")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_SURNAME."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_SURNAME."</SPAN></STRONG><br /><br />");
 		$_POST['surname'] = "";
 	}
 	if ($_POST['family_name'] == "!")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_FAMILY."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_FAMILY."</SPAN></STRONG><br /><br />");
 		$_POST['family_name'] = "";
 	}
 	if (($_POST['pass1'] == "!") && ($_POST['pass2'] == "!"))
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_BOTH_PASSWORDS."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_BOTH_PASSWORDS."</SPAN></STRONG><br /><br />");
 	}
 	 elseif ($_POST['pass1'] == "!")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_PASS1."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_PASS1."</SPAN></STRONG><br /><br />");
 	}
 	 elseif ($_POST['pass2'] == "!")
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_PASS2."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".ENTER_PASS2."</SPAN></STRONG><br /><br />");
 	}
 	if ($SHORT_PASS)
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".SHORT_PASS.": ".$CONFIG['pass_len']."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".SHORT_PASS.": ".$_CONFIG['pass_len']."</SPAN></STRONG><br /><br />");
 	}
 	if ($IP_TIMEOUT)
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".REMOTE_ADDR_TIMEOUT."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".REMOTE_ADDR_TIMEOUT."</SPAN></STRONG><br /><br />");
 	}
-	if ((!empty($cats)) && ($cats < $CONFIG['least_cats']))
+	if ((!empty($cats)) && ($cats < $_CONFIG['least_cats']))
 	{
-		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".CATS_LEAST.": ".$CONFIG['least_cats']."</SPAN></STRONG><BR><BR>");
+		OUTPUT_HTML("<STRONG><SPAN class=\"register_failed\">".CATS_LEAST.": ".$_CONFIG['least_cats']."</SPAN></STRONG><br /><br />");
 	}
 
 	// Generate birthday selection
@@ -416,10 +416,10 @@ array(
 	}
 
 	// Adds a table for the guests with all visible categories
-	define ('CATEGORY_SELECTION', REGISTER_ADD_CATEGORY_TABLE("guest", true));
+	define('CATEGORY_SELECTION', REGISTER_ADD_CATEGORY_TABLE("guest", true));
 
 	// Adds maximum receiveable mails list... :)
-	define ('MAX_RECEIVE_LIST', ADD_MAX_RECEIVE_LIST("guest", "", true));
+	define('MAX_RECEIVE_LIST', ADD_MAX_RECEIVE_LIST("guest", "", true));
 
 	// Check if nickname extension is active and get state if nickname is selected or userid
 	$nick = false;
@@ -428,9 +428,9 @@ array(
 	// Is the nickname valid?
 	if (!$nick) {
 		// Nope, disable it
-		if (GET_EXT_VERSION("sql_patches") != "") {
+		if (GET_EXT_VERSION("sql_patches") != '') {
 			// Use default refid
-			$GLOBALS['refid'] = $CONFIG['def_refid'];
+			$GLOBALS['refid'] = $_CONFIG['def_refid'];
 		} else {
 			// Set zero
 			$GLOBALS['refid'] = 0;
@@ -438,19 +438,19 @@ array(
 	}
 
 	// Shall I display the refid or shall I make it editable?
-	if ($CONFIG['display_refid'] == 'Y') {
+	if ($_CONFIG['display_refid'] == 'Y') {
 		// Load template to enter it
 		define('REFID_CONTENT', LOAD_TEMPLATE("guest_register_refid", true, $GLOBALS['refid']));
 	} else {
 		// Load "hide" form template
-		define ('REFID_CONTENT', LOAD_TEMPLATE("guest_register_refid_hide", true, $GLOBALS['refid']));
+		define('REFID_CONTENT', LOAD_TEMPLATE("guest_register_refid_hide", true, $GLOBALS['refid']));
 	}
 
 	// You may want to modify the register_header.tpl.xx file and not this script when you add your scripts etc. :-)
 	define('REGISTER_HEADER_CONTENT', LOAD_TEMPLATE("register_header", true));
 
 	// Please select at least x categories
-	define('LEAST_CATS_VALUE', $CONFIG['least_cats']);
+	define('LEAST_CATS_VALUE', $_CONFIG['least_cats']);
 
 	// Other values
 	define('__SURNAME', $_POST['surname']);   define('__FAMILY',  $_POST['family_name']);
@@ -463,9 +463,9 @@ array(
 	{
 		// New variant, good!
 		$OUT  = "<SELECT name=\"country_code\" class=\"guest_select\" size=\"1\">\n";
-		$WHERE = "WHERE is_active='Y'";
-		if (IS_ADMIN()) $WHERE = "";
-		$OUT .= ADD_OPTION_LINES("countries", "id", "descr", $_POST['country_code'], "code", $WHERE);
+		$whereStatement = "WHERE is_active='Y'";
+		if (IS_ADMIN()) $whereStatement = "";
+		$OUT .= ADD_OPTION_LINES("countries", "id", "descr", $_POST['country_code'], "code", $whereStatement);
 		$OUT .= "</SELECT>";
 		define('__COUNTRY_CONTENT', $OUT);
 	}