A rather large and important update:

revised most of the SQL queries and tried to make drupal as secure as possible (while trying to avoid redundant/duplicate checks).  For drupal's sake, try to screw something up.  See the mail about PHPNuke being hacked appr. 6 days ago.  The one who finds a problem is rewarded a beer (and I'm willing to ship it to Norway if required).  I beg you to be evil.  Try dumping a table a la "http://localhost/index.php?date=77778;DROP TABLE users" or something. ;)

1 files changed, 3 insertions, 3 deletions

diff --git a/modules/watchdog/watchdog.module b/modules/watchdog/watchdog.module
index f30ac4864..13908e39d 100644
--- a/modules/watchdog/watchdog.module
+++ b/modules/watchdog/watchdog.module
@@ -53,7 +53,7 @@ function watchdog_display($order = "date") {
 }
 
 function watchdog_view($id) {
-  $result = db_query("SELECT l.*, u.userid FROM watchdog l LEFT JOIN users u ON l.user = u.id WHERE l.id = $id");
+  $result = db_query("SELECT l.*, u.userid FROM watchdog l LEFT JOIN users u ON l.user = u.id WHERE l.id = '$id'");
 
   if ($watchdog = db_fetch_object($result)) {
     $output .= "<TABLE BORDER=\"1\" CELLPADDING=\"3\" CELLSPACING=\"0\">\n";
@@ -78,10 +78,10 @@ function watchdog_admin() {
       watchdog_help();
       break;
     case "view":
-      watchdog_view($id);
+      watchdog_view(check_input($id));
       break;
     case "Update":
-      watchdog_display($order);
+      watchdog_display(check_input($order));
       break;
     default:
       watchdog_display();