diff --git a/php/api.php b/php/api.php index 8e2baa5..8939aec 100755 --- a/php/api.php +++ b/php/api.php @@ -1,10 +1,10 @@ get(); - // Init plugins + # Init plugins $plugins = explode(';', $settings['plugins']); $plugins = new Plugins($plugins, $database); - // Escape + # Escape foreach(array_keys($_POST) as $key) $_POST[$key] = mysqli_real_escape_string($database, urldecode($_POST[$key])); foreach(array_keys($_GET) as $key) $_GET[$key] = mysqli_real_escape_string($database, urldecode($_GET[$key])); - // Validate parameters + # Validate parameters if (isset($_POST['albumIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['albumIDs'])!==1) exit('Error: Wrong parameter type for albumIDs!'); if (isset($_POST['photoIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['photoIDs'])!==1) exit('Error: Wrong parameter type for photoIDs!'); if (isset($_POST['albumID'])&&preg_match('/^[0-9sf]{1,}$/', $_POST['albumID'])!==1) exit('Error: Wrong parameter type for albumID!'); if (isset($_POST['photoID'])&&preg_match('/^[0-9]{14}$/', $_POST['photoID'])!==1) exit('Error: Wrong parameter type for photoID!'); - // Fallback for switch statement + # Fallback for switch statement if (!isset($_POST['function'])) $_POST['function'] = ''; if (!isset($_GET['function'])) $_GET['function'] = '';