--- fenglin/bbs/ch_username_sub.php	2004/12/05 10:00:19	1.3
+++ fenglin/bbs/ch_username_sub.php	2025/03/12 13:28:32	1.7
@@ -11,37 +11,38 @@ if ($_SESSION["BBS_uid"]==0)
 } 
 
 $permit = false;
-if (ereg("^[A-Za-z]{3,12}$",$_SESSION["BBS_username"]))
+if (preg_match("/^[A-Za-z]{3,12}$/",$_SESSION["BBS_username"]))
 {
-	error_msg ("您无权修改用户名！", true);
+	error_msg ("鎮ㄦ棤鏉冧慨鏀圭敤鎴峰悕锛�", true);
 	exit();
 }
 
-$username=htmlspecialchars(trim($_POST["username"]));
-$username=addslashes($username);
+$username=trim($_POST["username"]);
 
-if (!ereg("^[A-Za-z]{5,12}$",$username))
+if (!preg_match("/^[A-Za-z]{5,12}$/",$username))
 {
-	error_msg ("用户名填写不正确！", true);
+	error_msg ("鐢ㄦ埛鍚嶅～鍐欎笉姝ｇ‘锛�", true);
 	exit();
 }	
 if (!check_str($username))
 {
-	error_msg ("用户名含有系统保留词！", true);
+	error_msg ("鐢ㄦ埛鍚嶅惈鏈夌郴缁熶繚鐣欒瘝锛�", true);
 	exit();
 }
 
 $db_conn=include "./db_open.inc.php";
 
-$rs=mysql_query("select UID from user_list where username='$username' limit 1");
+$rs=mysql_query("select UID from user_list where username='" .
+	mysqli_real_escape_string($db_conn, $username) . "' limit 1");
 if (mysql_num_rows($rs)>0)
 {
-	error_msg ("用户名已存在！", true);
+	error_msg ("鐢ㄦ埛鍚嶅凡瀛樺湪锛�", true);
 	exit();
 }
 mysql_free_result($rs);
 
-mysql_query("update user_list set username='$username'".
+mysql_query("update user_list set username='" .
+	mysqli_real_escape_string($db_conn, $username) . "'".
 	" where UID=".$_SESSION["BBS_uid"])
 	or die("Update error!");