1 files changed, 8 insertions, 5 deletions

@@ -8,11 +8,14 @@ if (!isset($_GET['id']))
         exit;
 }
 
-$getcomic = "SELECT * FROM comics WHERE filename = \"" . mysqli_real_escape_string($mysql_conn, $_GET['id']) . ".png\"";
-$getcomic2 = mysql_query($getcomic);
-$getcomic3 = mysql_fetch_array($getcomic2);
-
-if ($getcomic3['filename'] != ($_GET['id'] . '.png'))
+$getcomic = $mysql_conn->prepare("SELECT * FROM comics WHERE filename = ?");
+$real_filename = $_GET['id'] . ".png";
+$getcomic->bind_param("s", $real_filename);
+$getcomic->execute();
+$getcomic2 = $getcomic->get_result();
+$getcomic3 = $getcomic2->fetch_assoc();
+
+if ($getcomic3['filename'] != $real_filename)
 {
         header('Location: /');
         exit;