Possible fix for bad escaping of single-quotes

diff --git a/inc/libs/security_functions.php b/inc/libs/security_functions.php
index c57d1e4c6eb35a638e4fdc997c61ad449847e051..7fc8a5ec11b4b2a9765d8a0abec56124d7ff3a3a 100644 (file)
--- a/inc/libs/security_functions.php
+++ b/inc/libs/security_functions.php
@@ -151,17 +151,12 @@ if (!isset($_POST)) {
        $_POST = $GLOBALS['_POST'];
 } // END - if
 
-// Include IP-Filter here
-//include("/usr/share/php/ipfilter.php");
-
 // Generate arrays which holds the relevante chars to replace
 $GLOBALS['security_chars'] = array(
        // The chars we are looking for...
-       'from' => array('{', '}', '/', '.', "'", '$', '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--'),
+       'from' => array('/', '.', "'", '$', '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--'),
        // ... and we will replace to.
        'to'   => array(
-               '{OPEN_ANCHOR2}',
-               '{CLOSE_ANCHOR2}',
                '{SLASH}',
                '{DOT}',
                '{QUOT}',

diff --git a/inc/template-functions.php b/inc/template-functions.php
index 768cf677c45cb627d5372797c3281dc2222a60fd..e29ca2856e1dabe47ab7ecead182b85a0d73ada8 100644 (file)
--- a/inc/template-functions.php
+++ b/inc/template-functions.php
@@ -242,7 +242,7 @@ function doFinalCompilation ($code, $insertComments = true) {
                // Compile it
                //* DEBUG: */ debugOutput('<pre>'.encodeEntities($code).'</pre>');
                $eval = '$newContent = "' . str_replace('{DQUOTE}', '"', compileCode(escapeQuotes($code))) . '";';
-               //* DEBUG: */ if ($insertComments) die('<pre>'.linenumberCode($eval).'</pre>');
+               //* DEBUG: */ if (!$insertComments) print('<pre>'.linenumberCode($eval).'</pre>');
                eval($eval);
                //* DEBUG: */ die('<pre>'.encodeEntities($newContent).'</pre>');
 
@@ -1450,6 +1450,9 @@ function escapeQuotes ($str, $single = false) {
                // Escape all (including null)
                $str = addslashes($str);
        } else {
+               // Remove escaping of single quotes
+               $str = str_replace("\'", "'", $str);
+
                // Escape only double-quotes but prevent double-quoting
                $str = str_replace("\\\\", "\\", str_replace('"', "\\\"", $str));
        }