zaiendi/shoppingcart — pull request #2 by snyff (2013-06-23 06:30:20+00:00)
Title: Fix directory traversal and SQL injection

Hi mate,

just a quick fix for 2 vulnerabilities. The PHP function basename will extract a filename from a path and will prevent people from doing ../../../etc/passwd for example. You may want to tweak the code if you need people to be able to access files/directory1/file1

The second function mysql_real_escape_string will prevent SQL injection for string (in most cases).

If you need more details, let me know.