switched to new query syntax - do quoting where it is needed

Dominik Mueller

2014-03-05 b45479611dea99bcdc6cdd276e0d47e7ad902a21

 interface/web/mail/mail_user_edit.php

@@ -203,9 +203,11 @@
         $maildir = str_replace("[localpart]", strtolower($_POST["email_local_part"]), $maildir);
         $this->dataRecord["maildir"] = $maildir;
         $this->dataRecord["homedir"] = $mail_config["homedir_path"];
         $this->dataRecord["uid"] = $mail_config["mailuser_uid"];
         $this->dataRecord["gid"] = $mail_config["mailuser_gid"];

			
         // Will be overwritten by mail_plugin
         $this->dataRecord['uid'] = -1;
         $this->dataRecord['gid'] = -1;
				
         //* Check if there is no alias or forward with this address
         $tmp = $app->db->queryOneRecord("SELECT count(forwarding_id) as number FROM mail_forwarding WHERE active = 'y' AND source = '".$app->db->quote($this->dataRecord["email"])."'");
         if($tmp['number'] > 0) $app->tform->errorMessage .= $app->tform->lng("duplicate_alias_or_forward_txt")."<br>";
@@ -300,7 +302,7 @@
         $disabledeliver = ($this->dataRecord["postfix"] == 'y')?'n':'y';
         $disablesmtp = ($this->dataRecord["postfix"] == 'y')?'n':'y';

         $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
         $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', `disablesieve-filter` = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
         $app->db->query($sql);
      }