From: Banana <banana@starscream.de>
Date: Thu, 16 Jun 2011 13:42:24 +0000 (+0200)
Subject: add a bookmark and make the sql querie save
X-Git-Tag: 2.1-alpha-2019-0-29~112
X-Git-Url: http://91.132.146.200/gitweb/?a=commitdiff_plain;h=db8544c591aae1535ec84eb93d34aa1dd4b8154b;p=insipid.git

add a bookmark and make the sql querie save
---

diff --git a/TODO b/TODO
index bd6d5d5..7e4c9e6 100755
--- a/TODO
+++ b/TODO
@@ -1,8 +1,6 @@
 For 1.0
 ==========================================================================
 - Quote marks screw up adding a bookmark
-- Move htaccess management into the configuration page
-
 
 Everything else
 ==========================================================================
diff --git a/lib/Insipid/Bookmarks.pm b/lib/Insipid/Bookmarks.pm
index 25bbf52..13c4fb0 100755
--- a/lib/Insipid/Bookmarks.pm
+++ b/lib/Insipid/Bookmarks.pm
@@ -85,7 +85,7 @@ sub add_bookmark {
 	if($epoch eq 0) { $epoch = time; }
 	$sth = $dbh->prepare($sql);
 
-	$sth->execute($url, $md5, $title, $description, $access_level, $epoch)
+	$sth->execute($url, $md5, $dbh->quote($title), $dbh->quote($description), $access_level, $epoch)
 		or die $DBI::errstr;
 	
 	$icount++;
diff --git a/lib/Insipid/Main.pm b/lib/Insipid/Main.pm
index 507a67c..04f55b7 100755
--- a/lib/Insipid/Main.pm
+++ b/lib/Insipid/Main.pm
@@ -54,6 +54,7 @@ use MIME::Base64;
 use LWP::UserAgent;
 use HTTP::Request;
 use HTTP::Response;
+use Data::Validate::URI qw(is_uri);
 
 my $NL = "<br />\n";
 my @valid;
@@ -294,6 +295,11 @@ IFORM
 					print "URL or Title can not be empty";
 					exit;
 				}
+				
+				if(!is_uri($url)) {
+					print "This is not a valid URL";
+					exit;
+				}
 
                 if (defined(param('access_level'))) {
                     if (param('access_level') eq 'on') {
diff --git a/lib/Insipid/Tags.pm b/lib/Insipid/Tags.pm
index 0a5148d..3b98a7f 100755
--- a/lib/Insipid/Tags.pm
+++ b/lib/Insipid/Tags.pm
@@ -304,7 +304,7 @@ sub set_tags {
 	    if ($tagcount < 1) {
 			my $sql = "insert into $tbl_tags (name) values(?)";
 			my $sth = $dbh->prepare($sql);
-			$sth->execute($cur);
+			$sth->execute($dbh->quote($cur));
 	    }
 
 	    # and fetch the tag ID