From 74ec84ba871e86491a79a21b85cf37126b41cc7a Mon Sep 17 00:00:00 2001
From: Alexander Schmidt <alex@treefish.org>
Date: Mon, 1 Oct 2012 17:28:58 +0200
Subject: [PATCH 1/1] ...

---
 include/common.inc    | 14 ++++++++++----
 include/usercheck.inc |  7 +++++++
 register.php          |  7 +++++++
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/include/common.inc b/include/common.inc
index 38de013..4b1a17a 100644
--- a/include/common.inc
+++ b/include/common.inc
@@ -1,7 +1,13 @@
 <?php
-  function block($color, $text) {
-    print "<table bgcolor=\" $color \">";
-      print "<tr><th><b><font color=\"white\"> $text </font></b></th><tr>";
-    print "</table>";
+  if( ! isset($COMMON_H)) {
+
+    $COMMON_H = 1;
+
+    function block($color, $text) {
+      print "<table bgcolor=\" $color \">";
+        print "<tr><th><b><font color=\"white\"> $text </font></b></th><tr>";
+      print "</table>";
+    }
+
   }
 ?>
diff --git a/include/usercheck.inc b/include/usercheck.inc
index 27cecff..26ab851 100644
--- a/include/usercheck.inc
+++ b/include/usercheck.inc
@@ -1,9 +1,16 @@
 <?php
+
   require 'db.inc';
+  require 'common.inc';
 
   $mnumber = $_POST['mnumber'];
   $password = $_POST['password'];
 
+  if(! is_numeric($mnumber)) {
+    block("red", "Matr.nummer has to be numeric!");
+    exit;
+  }
+
   if($db->query("SELECT COUNT(*) FROM students WHERE mnumber = $mnumber")->fetch(PDO::FETCH_NUM)[0] == 0) {
     print '<table bgcolor="red">';
       print '<tr><th><b><font color="white">Mat.nummer not found</font></b></th><tr>';
diff --git a/register.php b/register.php
index fc6eb4b..e63872b 100644
--- a/register.php
+++ b/register.php
@@ -1,6 +1,8 @@
 <?php
 require 'include/head.inc';
 require 'include/prefs.inc';
+require 'include/common.inc';
+
 
 if(isset($_POST['submit']) && $_POST['firstname']!="" && $_POST['lastname']!="" 
 			   && $_POST['mnumber']!="" && $_POST['email']!="" && $_POST['password']!="")
@@ -11,6 +13,11 @@ if(isset($_POST['submit']) && $_POST['firstname']!="" && $_POST['lastname']!=""
   $email = $_POST['email'];
   $password = $_POST['password'];
 
+  if( ! is_numeric($mnumber) ) {
+    block("red", "Mat.nummer has to be numeric!");
+    exit;
+  }
+
   require 'include/db.inc';
 
   // user already exists //
-- 
2.39.5