From 6ce01377ed29e9e23a9ceb3cad7c524e969154f0 Mon Sep 17 00:00:00 2001
From: cookie <cookie@29ba0400-6e00-0410-a75a-ca02368028f8>
Date: Wed, 19 Apr 2006 17:29:11 +0000
Subject: [PATCH] typo erweitert

git-svn-id: svn://svn.cccv.de/engel-system@123 29ba0400-6e00-0410-a75a-ca02368028f8
---
 www-ssl/inc/funktion_db.php | 17 ++++++++++-------
 www-ssl/inc/header.php      |  2 +-
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/www-ssl/inc/funktion_db.php b/www-ssl/inc/funktion_db.php
index 06decc47..0c54c2d3 100644
--- a/www-ssl/inc/funktion_db.php
+++ b/www-ssl/inc/funktion_db.php
@@ -31,7 +31,7 @@ if( !function_exists("db_query"))
 
 	function db_query( $SQL, $comment)
 	{
-		global $con;	
+		global $con, $Page;	
 		
 		//commed anlyse udn daten sicherung
 		$Diff = "";
@@ -41,6 +41,9 @@ if( !function_exists("db_query"))
 			$Table_Start = strpos( $SQL, "`");
 			$Table_End   = strpos( $SQL, "`", $Table_Start+1);
 			$Table = substr( $SQL, $Table_Start, ($Table_End-$Table_Start+1));
+			
+			//SecureTest
+			if( $Table_Start == 0 || $Table_End == 0) die("<h1>funktion_db ERROR SQL: '$SQL' nicht OK</h1>");
 	
 			//WHERE ermitteln
 			$Where_Start = strpos( $SQL, "WHERE");
@@ -79,19 +82,19 @@ if( !function_exists("db_query"))
 		}
 
 		//abschneiden wenn zu lang
-		if( strlen( $Diff) > 5120) 	$Diff = "too mutch (len ". strlen( $Diff). ")";
+		if( strlen( $Where) < 2) 	$Diff = "can't show, too mutch data (no filter was set)";
+//		if( strlen( $Diff) > 5120) 	$Diff = "too mutch (len ". strlen( $Diff). "bytes)";
 
+		$SQLCommand = "SQL:<br>". htmlentities( $SQL, ENT_QUOTES). "<br><br>Diff:<br>$Diff";
+		$Commend = htmlentities( ($Page["Name"]. ": ". $comment), ENT_QUOTES);
 		//LOG commands in DB
 		$SQL_SEC =	"INSERT INTO `ChangeLog` ( `UID` , `SQLCommad` , `Commend` ) ".
 				" VALUES ( ".
 					"'". $_SESSION['UID']. "', ".
-					"'SQL:<br>". htmlentities( $SQL, ENT_QUOTES). "<br><br>".
-					 "Diff:<br>$Diff', ".
-					"'". htmlentities( $comment, ENT_QUOTES). "' );";
+					"'". mysql_escape_string( $SQLCommand). "', ".
+					"'". mysql_escape_string( $Commend). "' );";
 		$erg = mysql_query($SQL_SEC, $con);
-echo "##$erg";
 		echo mysql_error($con);
-echo "##";
 		return $querry_erg;
 	}//function db_query(
 }
diff --git a/www-ssl/inc/header.php b/www-ssl/inc/header.php
index 8d5a1341..c7c13957 100755
--- a/www-ssl/inc/header.php
+++ b/www-ssl/inc/header.php
@@ -2,7 +2,7 @@
 include ("./inc/config.php");
 include ("./inc/db.php");
 include ("./inc/funktion_lang.php");
-include("./inc/funktion_menu.php");
+include ("./inc/funktion_menu.php");
 session_start(); 
 include ("./inc/secure.php");
 /*if ( (!IsSet($_SESSION['UID'])) && (strstr ($_SERVER['PHP_SELF'], "nonpublic") !="" ) ) {