1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
| <?php if (isset($_GET['id_newsletter'])) {
require_once('config.inc.php');
$val = intval($_GET['id_newsletter']);
$requete=mysql_query("SELECT objet, contenu FROM n_newsletters WHERE id_newsletter='$val'");
$result=mysql_query ($requete);
mysql_close();
list($objetnews,$cont)=mysql_fetch_row($requete);
}
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Modification newsletter</title>
</head>
<body>
<?php // ANTI-INJECTION SQL + XSS
function protection($valeur) {
$valeur = stripslashes($valeur);
$valeur = htmlspecialchars($valeur);
$valeur = htmlentities($valeur);
return @mysql_real_escape_string($valeur);
}
?>
<link rel="stylesheet" href="admin.css" type="text/css"/>
<form method="post" name="form1" action="PubLetter.php">
<table align="center">
<tr valign="baseline">
<td nowrap align="right">Modif objet:</td>
<td><input type="text" name="Objet" id="Objet" value="<?php echo "$objetnews"; ?>" size="106"></td>
</tr>
<tr valign="baseline">
<td nowrap align="right" valign="top">Modif contenu:</td>
<td><textarea name="Contenu" id="Contenu" cols="80" rows="12"><?php echo "$cont"; ?></textarea>
</td>
</tr>
<tr valign="baseline">
<td nowrap align="right"> </td>
<td><input type="submit" value="MAJ newsletter !"></td>
</tr>
</table>
</form>
<?php
//initialize the session
if (!isset($_SESSION)) {
session_start();
}
<?php
$BD_serveur = "mondomaine";
$BD_utilisateur = "mondomaine";
$BD_pwd = "mondomaine1";
$BD_base = "mondomaine";
$connection = mysql_connect($BD_serveur, $BD_utilisateur, $BD_pwd);
mysql_select_db( $BD_base , $connection) or die("Impossible d'accèder à la base de données");
if (isset($_POST['Objet']))
{
if(mysql_errno()==0)
{
if ($_POST['Objet']!="")
{
$valeur = protection($_POST['Objet']);
$val = intval($_GET['id_newsletter']);
mysql_query ("UPDATE n_newsletters SET objet='$valeur' WHERE id_newsletter='$val'");
}
}
}
if (isset($_POST['Contenu']))
{
if(mysql_errno()==0)
{
if ($_POST['Contenu']!="")
{
$valeur = protection($_POST['Contenu']);
$val = intval($_GET['id_newsletter']);
mysql_query ("UPDATE n_newsletters SET contenu='$valeur' WHERE id_newsletter='$val'");
}
}
}
if (isset($_POST['Objet']) || isset($_POST['Contenu']) )
{
echo "<meta http-equiv='Refresh' content='0;URL='modif_newsletter.php?id_newsletter='$val''>";
}
mysql_close();
?>
<b>Retour sous admin : </b><a href="admin_newsletter.php"><u>Admin</u></a></u></b>
</body>
</html> |
Partager