From 75512ae3dcd149a3bb8ee9df980484661460e507 Mon Sep 17 00:00:00 2001
From: Dries Buytaert <dries@buytaert.net>
Date: Wed, 23 Jul 2003 19:48:08 +0000
Subject: - Fixed the update path of user_save().  Patch by Gerhard. Tnx.

---
 modules/user/user.module | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'modules/user/user.module')

diff --git a/modules/user/user.module b/modules/user/user.module
index 0f5742385..5c87b2a09 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -97,22 +97,25 @@ function user_save($account, $array = array()) {
     $data = unserialize(db_result(db_query("SELECT data FROM {users} WHERE uid = %d", $account->uid)));
     foreach ($array as $key => $value) {
       if ($key == "pass") {
-        $query .= "$key = '". md5($value) ."', ";
+        $query .= "$key = '%s', ";
+        $v[] = md5($value);
       }
       else if (substr($key, 0, 4) !== "auth") {
         if (in_array($key, $user_fields)) {
           // escape '%'s:
           $value = str_replace("%", "%%", $value);
-          $query .= "$key = '". check_query($value) ."', ";
+          $query .= "$key = '%s', ";
+          $v[] = $value;
         }
         else {
           $data[$key] = $value;
         }
       }
     }
-    $query .= "data = '". check_query(serialize($data)) ."', ";
+    $query .= "data = '%s', ";
+    $v[] = serialize($data);
 
-    db_query("UPDATE {users} SET $query timestamp = %d WHERE uid = %d", time(), $account->uid);
+    db_query("UPDATE {users} SET $query timestamp = %d WHERE uid = %d", array_merge($v, array(time(), $account->uid)));
 
     $user = user_load(array("uid" => $account->uid));
   }
-- 
cgit v1.2.3