1 files changed, 37 insertions, 21 deletions

diff --git a/tools/bddb/doedit.php b/tools/bddb/doedit.php
index 110ecf3..13fbb69 100644
--- a/tools/bddb/doedit.php
+++ b/tools/bddb/doedit.php
@@ -1,7 +1,7 @@
 <?php // php pages made with phpMyBuilder <http://kyber.dk/phpMyBuilder> ?>
 <?php
 	// (C) Copyright 2001
-	// Murray Jensen <Murray.Jensen@cmst.csiro.au>
+	// Murray Jensen <Murray.Jensen@csiro.au>
 	// CSIRO Manufacturing Science and Technology, Preston Lab
 
 	// doedit page (hymod_bddb / boards)
@@ -10,18 +10,21 @@
 
 	pg_head("$bddb_label - Edit Board Results");
 
-	if ($serno == 0)
+	if (!isset($_REQUEST['serno']) || $_REQUEST['serno'] == '')
 		die("the board serial number was not specified");
+	$serno=intval($_REQUEST['serno']);
 
 	$query="update boards set";
 
-	if (isset($ethaddr)) {
+	if (isset($_REQUEST['ethaddr'])) {
+		$ethaddr=$_REQUEST['ethaddr'];
 		if (!eth_addr_is_valid($ethaddr))
 			die("ethaddr is invalid ('$ethaddr')");
 		$query.=" ethaddr='$ethaddr',";
 	}
 
-	if (isset($date)) {
+	if (isset($_REQUEST['date'])) {
+		$date=$_REQUEST['date'];
 		list($y, $m, $d) = split("-", $date);
 		if (!checkdate($m, $d, $y) || $y < 1999)
 			die("date is invalid (input '$date', " .
@@ -29,31 +32,36 @@
 		$query.=" date='$date'";
 	}
 
-	if (isset($batch)) {
+	if (isset($_REQUEST['batch'])) {
+		$batch=$_REQUEST['batch'];
 		if (strlen($batch) > 32)
 			die("batch field too long (>32)");
 		$query.=", batch='$batch'";
 	}
 
-	if (isset($type)) {
+	if (isset($_REQUEST['type'])) {
+		$type=$_REQUEST['type'];
 		if (!in_array($type, $type_vals))
 			die("Invalid type ($type) specified");
 		$query.=", type='$type'";
 	}
 
-	if (isset($rev)) {
+	if (isset($_REQUEST['rev'])) {
+		$rev=$_REQUEST['rev'];
 		if (($rev = intval($rev)) <= 0 || $rev > 255)
 			die("Revision number is invalid ($rev)");
 		$query.=sprintf(", rev=%d", $rev);
 	}
 
-	if (isset($location)) {
+	if (isset($_REQUEST['location'])) {
+		$location=$_REQUEST['location'];
 		if (strlen($location) > 64)
 			die("location field too long (>64)");
 		$query.=", location='$location'";
 	}
 
-	if (isset($comments))
+	if (isset($_REQUEST['comments']))
+		$comments=$_REQUEST['comments'];
 		$query.=", comments='" . rawurlencode($comments) . "'";
 
 	$query.=gather_enum_multi_query("sdram", 4);
@@ -77,46 +85,54 @@
 	if (count_enum_multi("xlxgrd", 4) != $nxlx)
 		die("number of xilinx grades not same as number of types");
 
-	if (isset($cputyp)) {
+	if (isset($_REQUEST['cputyp'])) {
+		$cputyp=$_REQUEST['cputyp'];
 		$query.=", cputyp='$cputyp'";
-		if ($cpuspd == '')
+		if (!isset($_REQUEST['cpuspd']) || $_REQUEST['cpuspd'] == '')
 			die("must specify cpu speed if cpu type is defined");
+		$cpuspd=$_REQUEST['cpuspd'];
 		$query.=", cpuspd='$cpuspd'";
-		if ($cpmspd == '')
+		if (!isset($_REQUEST['cpmspd']) || $_REQUEST['cpmspd'] == '')
 			die("must specify cpm speed if cpu type is defined");
+		$cpmspd=$_REQUEST['cpmspd'];
 		$query.=", cpmspd='$cpmspd'";
-		if ($busspd == '')
+		if (!isset($_REQUEST['busspd']) || $_REQUEST['busspd'] == '')
 			die("must specify bus speed if cpu type is defined");
+		$busspd=$_REQUEST['busspd'];
 		$query.=", busspd='$busspd'";
 	}
 	else {
-		if (isset($cpuspd))
+		if (isset($_REQUEST['cpuspd']))
 			die("can't specify cpu speed if there is no cpu");
-		if (isset($cpmspd))
+		if (isset($_REQUEST['cpmspd']))
 			die("can't specify cpm speed if there is no cpu");
-		if (isset($busspd))
+		if (isset($_REQUEST['busspd']))
 			die("can't specify bus speed if there is no cpu");
 	}
 
-	if (isset($hschin)) {
+	if (isset($_REQUEST['hschin'])) {
+		$hschin=$_REQUEST['hschin'];
 		if (($hschin = intval($hschin)) < 0 || $hschin > 4)
 			die("Invalid number of hs input chans ($hschin)");
 	}
 	else
 		$hschin = 0;
-	if (isset($hschout)) {
+	if (isset($_REQUEST['hschout'])) {
+		$hschout=$_REQUEST['hschout'];
 		if (($hschout = intval($hschout)) < 0 || $hschout > 4)
 			die("Invalid number of hs output chans ($hschout)");
 	}
 	else
 		$hschout = 0;
-	if (isset($hstype))
+	if (isset($_REQUEST['hstype'])) {
+		$hstype=$_REQUEST['hstype'];
 		$query.=", hstype='$hstype'";
+	}
 	else {
-		if ($hschin != 0)
+		if ($_REQUEST['hschin'] != 0)
 			die("number of high-speed input channels must be zero"
 				. " if high-speed chip is not present");
-		if ($hschout != 0)
+		if ($_REQUEST['hschout'] != 0)
 			die("number of high-speed output channels must be zero"
 				. " if high-speed chip is not present");
 	}