gistfile1.php

git diff actions.php
diff --git a/web/includes/actions.php b/web/includes/actions.php
index 1892464..a55ffb1 100644
--- a/web/includes/actions.php
+++ b/web/includes/actions.php
@@ -767,8 +767,15 @@ if ( !empty($action) )

                 if ( isset($newValue) && ($newValue != $value['Value']) )
                 {
-                    dbQuery( "update Config set Value = '".$newValue."' where Name = '".$name."'" );
-                    $changed = true;
+                    $newValue = mysqli_real_escape_string($dbConn, $newValue);
+                    if ($stmt = mysqli_prepare($dbConn, "UPDATE Config SET Value = ? WHERE Name = ?"))
+                    {
+                        mysqli_stmt_bind_param($stmt, "ss", $newValue, $name);
+                        mysqli_stmt_execute($stmt);
+                        $changed = true;
+                        mysqli_stmt_close($stmt);
+                    }
+#                   dbQuery( "update Config set Value = '".$newValue."' where Name = '".$name."'" );
                 }
             }
             if ( $changed )