Hi, rss.php is vulnerable to sql injection via albumtitle=whatever&albumname=whatever'"

I actually don't think as these query parameter values are sanitized via our sanitize() function before they are used.

zenphoto version 1.2.9 [5088]

/rss.php?albumtitle=blah&albumname=zob'"

`
SELECT images.albumid, images.filename AS filename, images.mtime as mtime, images.title AS title, albums.folder AS folder, images.show, albums.show, albums.password FROM [code]zp_images[/code] AS images, [code]zp_albums[/code] AS albums WHERE albums.folder = 'zob'"' AND images.albumid = albums.id AND images.show=1 AND albums.folder != '' AND albums.show=1 AND albums.folder != '' ORDER BY images.id DESC LIMIT 10

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"' AND images.albumid = albums.id AND images.show=1 AND albums.folder != '' AND' at line 1
`

But that does no harm if the values make no sense to Zenphoto and just throws that error.

We double checked that and you are actually right. So fix will be in tonight's nightly.