From f15ecc14b4480a1d846a60218d9b3928b005f9cb Mon Sep 17 00:00:00 2001
From: chicpro <chicpro@gmail.com>
Date: Fri, 7 Feb 2014 10:43:05 +0900
Subject: [PATCH] =?UTF-8?q?=EC=98=B5=EC=85=98=EC=A0=95=EB=B3=B4=EC=9D=98?=
 =?UTF-8?q?=20=EB=94=B0=EC=98=B4=ED=91=9C=20=EC=A0=9C=EA=B1=B0=EB=90=98?=
 =?UTF-8?q?=EB=8F=84=EB=A1=9D=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/itemform.php   |  4 ++--
 adm/shop_admin/itemoption.php | 12 ++++++------
 adm/shop_admin/itemsupply.php |  6 +++---
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/adm/shop_admin/itemform.php b/adm/shop_admin/itemform.php
index f76bbc76f..2b90ffc16 100644
--- a/adm/shop_admin/itemform.php
+++ b/adm/shop_admin/itemform.php
@@ -582,7 +582,7 @@ $(function(){
             <th scope="row">상품선택옵션</th>
             <td colspan="2">
                 <div class="sit_option tbl_frm01">
-                    <?php echo help('옵션항목은 콤마(,) 로 구분하여 여러개를 입력할 수 있습니다. 예시) 라지,미디움,스몰'); ?>
+                    <?php echo help('옵션항목은 콤마(,) 로 구분하여 여러개를 입력할 수 있습니다. 예시) 라지,미디움,스몰<br><strong>옵션명과 옵션항목에 따옴표(\', ")는 입력할 수 없습니다.</strong>'); ?>
                     <table>
                     <caption>상품선택옵션 입력</caption>
                     <colgroup>
@@ -740,7 +740,7 @@ $(function(){
             <th scope="row">상품추가옵션</th>
             <td colspan="2">
                 <div id="sit_supply_frm" class="sit_option tbl_frm01">
-                    <?php echo help('옵션항목은 콤마(,) 로 구분하여 여러개를 입력할 수 있습니다. 예시) 라지,미디움,스몰'); ?>
+                    <?php echo help('옵션항목은 콤마(,) 로 구분하여 여러개를 입력할 수 있습니다. 예시) 라지,미디움,스몰<br><strong>옵션명과 옵션항목에 따옴표(\', ")는 입력할 수 없습니다.</strong>'); ?>
                     <table>
                     <caption>상품추가옵션 입력</caption>
                     <colgroup>
diff --git a/adm/shop_admin/itemoption.php b/adm/shop_admin/itemoption.php
index 98cef6300..a078a46c4 100644
--- a/adm/shop_admin/itemoption.php
+++ b/adm/shop_admin/itemoption.php
@@ -14,13 +14,13 @@ if($it['it_id']) {
     if(mysql_num_rows($result))
         $po_run = true;
 } else if(!empty($_POST)) {
-    $opt1_subject = trim($_POST['opt1_subject']);
-    $opt2_subject = trim($_POST['opt2_subject']);
-    $opt3_subject = trim($_POST['opt3_subject']);
+    $opt1_subject = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['opt1_subject'])));
+    $opt2_subject = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['opt2_subject'])));
+    $opt3_subject = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['opt3_subject'])));
 
-    $opt1_val = trim($_POST['opt1']);
-    $opt2_val = trim($_POST['opt2']);
-    $opt3_val = trim($_POST['opt3']);
+    $opt1_val = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['opt1'])));
+    $opt2_val = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['opt2'])));
+    $opt3_val = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['opt3'])));
 
     if(!$opt1_subject || !$opt1_val) {
         echo '옵션1과 옵션1 항목을 입력해 주십시오.';
diff --git a/adm/shop_admin/itemsupply.php b/adm/shop_admin/itemsupply.php
index 41b8e32bc..4b018e980 100644
--- a/adm/shop_admin/itemsupply.php
+++ b/adm/shop_admin/itemsupply.php
@@ -84,12 +84,12 @@ if($ps_run) {
         } // for
     } else {
         for($i=0; $i<$subject_count; $i++) {
-            $spl_subject = trim($_POST['subject'][$i]);
-            $spl_val = explode(',', trim($_POST['supply'][$i]));
+            $spl_subject = preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['subject'][$i])));
+            $spl_val = explode(',', preg_replace('/[\'\"]/', '', trim(stripslashes($_POST['supply'][$i]))));
             $spl_count = count($spl_val);
 
             for($j=0; $j<$spl_count; $j++) {
-                $spl = trim($spl_val[$j]);
+                $spl = strip_tags(trim($spl_val[$j]));
                 if($spl_subject && $spl) {
                     $spl_id = $spl_subject.chr(30).$spl;
                     $spl_price = 0;