|
|
@@ -13,6 +13,7 @@ class Alter {
|
|
13
|
13
|
public static function addNews($author, $title, $content, $image, $type) {
|
|
14
|
14
|
$db = new DBClass();
|
|
15
|
15
|
$time = new DateTime();
|
|
|
16
|
+ // Sanitize number
|
|
16
|
17
|
$type = filter_var(trim($type), FILTER_SANITIZE_NUMBER_INT);
|
|
17
|
18
|
$sql = "INSERT INTO `news` (`id`, `author`, `time`, `title`, `type`, `content`, `img`) VALUES (NULL, '$author', '" . $time->getTimestamp() . "', '$title', '$type', '$content', '$image');";
|
|
18
|
19
|
$db->query($sql);
|
|
|
@@ -22,6 +23,7 @@ class Alter {
|
|
22
|
23
|
|
|
23
|
24
|
public static function editNews($id, $title, $content, $image, $type) {
|
|
24
|
25
|
$db = new DBClass();
|
|
|
26
|
+ // Sanitize number
|
|
25
|
27
|
$type = filter_var(trim($type), FILTER_SANITIZE_NUMBER_INT);
|
|
26
|
28
|
if ($image != false) {
|
|
27
|
29
|
$sql = "UPDATE `news` SET `title` = '$title', `img` = '$image', `content` = '$content', `type` = '$type' WHERE `news`.`id` = $id;";
|