--- fenglin/bbs/ch_username_sub.php	2013/01/05 13:44:28	1.5
+++ fenglin/bbs/ch_username_sub.php	2025/03/26 11:48:07	1.8
@@ -6,42 +6,43 @@
 <? 
 if ($_SESSION["BBS_uid"]==0)
 {
-	include "./force_login.inc.php";
+	echo ("尚未登陆");
 	exit();
 } 
 
 $permit = false;
 if (preg_match("/^[A-Za-z]{3,12}$/",$_SESSION["BBS_username"]))
 {
-	error_msg ("����Ȩ�޸��û�����", true);
+	error_msg ("您无权修改用户名！", true);
 	exit();
 }
 
-$username=htmlspecialchars(trim($_POST["username"]), ENT_COMPAT | ENT_HTML401, 'GB2312');
-$username=addslashes($username);
+$username=trim($_POST["username"]);
 
 if (!preg_match("/^[A-Za-z]{5,12}$/",$username))
 {
-	error_msg ("�û�����д����ȷ��", true);
+	error_msg ("用户名填写不正确！", true);
 	exit();
 }	
 if (!check_str($username))
 {
-	error_msg ("�û�������ϵͳ�����ʣ�", true);
+	error_msg ("用户名含有系统保留词！", true);
 	exit();
 }
 
 $db_conn=include "./db_open.inc.php";
 
-$rs=mysql_query("select UID from user_list where username='$username' limit 1");
+$rs=mysql_query("select UID from user_list where username='" .
+	mysqli_real_escape_string($db_conn, $username) . "' limit 1");
 if (mysql_num_rows($rs)>0)
 {
-	error_msg ("�û����Ѵ��ڣ�", true);
+	error_msg ("用户名已存在！", true);
 	exit();
 }
 mysql_free_result($rs);
 
-mysql_query("update user_list set username='$username'".
+mysql_query("update user_list set username='" .
+	mysqli_real_escape_string($db_conn, $username) . "'".
 	" where UID=".$_SESSION["BBS_uid"])
 	or die("Update error!");