From db8544c591aae1535ec84eb93d34aa1dd4b8154b Mon Sep 17 00:00:00 2001
From: Banana <banana@starscream.de>
Date: Thu, 16 Jun 2011 15:42:24 +0200
Subject: [PATCH] add a bookmark and make the sql querie save

---
 TODO                     | 2 --
 lib/Insipid/Bookmarks.pm | 2 +-
 lib/Insipid/Main.pm      | 6 ++++++
 lib/Insipid/Tags.pm      | 2 +-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/TODO b/TODO
index bd6d5d5..7e4c9e6 100755
--- a/TODO
+++ b/TODO
@@ -1,8 +1,6 @@
 For 1.0
 ==========================================================================
 - Quote marks screw up adding a bookmark
-- Move htaccess management into the configuration page
-
 
 Everything else
 ==========================================================================
diff --git a/lib/Insipid/Bookmarks.pm b/lib/Insipid/Bookmarks.pm
index 25bbf52..13c4fb0 100755
--- a/lib/Insipid/Bookmarks.pm
+++ b/lib/Insipid/Bookmarks.pm
@@ -85,7 +85,7 @@ sub add_bookmark {
 	if($epoch eq 0) { $epoch = time; }
 	$sth = $dbh->prepare($sql);
 
-	$sth->execute($url, $md5, $title, $description, $access_level, $epoch)
+	$sth->execute($url, $md5, $dbh->quote($title), $dbh->quote($description), $access_level, $epoch)
 		or die $DBI::errstr;
 	
 	$icount++;
diff --git a/lib/Insipid/Main.pm b/lib/Insipid/Main.pm
index 507a67c..04f55b7 100755
--- a/lib/Insipid/Main.pm
+++ b/lib/Insipid/Main.pm
@@ -54,6 +54,7 @@ use MIME::Base64;
 use LWP::UserAgent;
 use HTTP::Request;
 use HTTP::Response;
+use Data::Validate::URI qw(is_uri);
 
 my $NL = "<br />\n";
 my @valid;
@@ -294,6 +295,11 @@ IFORM
 					print "URL or Title can not be empty";
 					exit;
 				}
+				
+				if(!is_uri($url)) {
+					print "This is not a valid URL";
+					exit;
+				}
 
                 if (defined(param('access_level'))) {
                     if (param('access_level') eq 'on') {
diff --git a/lib/Insipid/Tags.pm b/lib/Insipid/Tags.pm
index 0a5148d..3b98a7f 100755
--- a/lib/Insipid/Tags.pm
+++ b/lib/Insipid/Tags.pm
@@ -304,7 +304,7 @@ sub set_tags {
 	    if ($tagcount < 1) {
 			my $sql = "insert into $tbl_tags (name) values(?)";
 			my $sth = $dbh->prepare($sql);
-			$sth->execute($cur);
+			$sth->execute($dbh->quote($cur));
 	    }
 
 	    # and fetch the tag ID
-- 
2.39.5