Index: branches/beta/html/admin/products/upload_csv.php
===================================================================
--- branches/beta/html/admin/products/upload_csv.php	(revision 15120)
+++ branches/beta/html/admin/products/upload_csv.php	(revision 15471)
@@ -45,5 +45,5 @@
 	// ¥¨¥é¡¼¥Á¥§¥Ã¥¯
 	$arrErr['csv_file'] = $objUpFile->makeTempFile('csv_file');
-	
+
 	if($arrErr['css_file'] == "") {
 		$arrErr = $objUpFile->checkEXISTS();
@@ -52,11 +52,11 @@
 	// ¼Â¹Ô»þ´Ö¤òÀ©¸Â¤·¤Ê¤¤
 	set_time_limit(0);
-	
+
 	// ½ÐÎÏ¤ò¥Ð¥Ã¥Õ¥¡¥ê¥ó¥°¤·¤Ê¤¤(==ÆüËÜ¸ì¼«Æ°ÊÑ´¹¤â¤·¤Ê¤¤)
 	ob_end_clean();
-	
+
 	// IE¤Î¤¿¤á¤Ë256¥Ð¥¤¥È¶õÊ¸»ú½ÐÎÏ
 	echo str_pad('',256);
-		
+
 	if($arrErr['csv_file'] == "") {
 		// °ì»þ¥Õ¥¡¥¤¥ëÌ¾¤Î¼èÆÀ
@@ -64,35 +64,35 @@
 		// ¥¨¥ó¥³¡¼¥É
 		$enc_filepath = sfEncodeFile($filepath, CHAR_CODE, CSV_TEMP_DIR);
-		
+
 		// ¥ì¥³¡¼¥É¿ô¤òÆÀ¤ë
-		$rec_count = lfCSVRecordCount($enc_filepath);		
-		
+		$rec_count = lfCSVRecordCount($enc_filepath);
+
 		$fp = fopen($enc_filepath, "r");
 		$line = 0;		// ¹Ô¿ô
 		$regist = 0;	// ÅÐÏ¿¿ô
-		
+
 		$objQuery = new SC_Query();
 		$objQuery->begin();
-		
-		echo "¢£¡¡CSVÅÐÏ¿¿ÊÄ½¾õ¶· <br/><br/>\n";				
-				
+
+		echo "¢£¡¡CSVÅÐÏ¿¿ÊÄ½¾õ¶· <br/><br/>\n";
+
 		while(!feof($fp) && !$err) {
 			$arrCSV = fgetcsv($fp, CSV_LINE_MAX);
-						
+
 			// ¹Ô¥«¥¦¥ó¥È
 			$line++;
-			
+
 			if($line <= 1) {
 				continue;
-			}			
-								
+			}
+
 			// ¹àÌÜ¿ô¥«¥¦¥ó¥È
 			$max = count($arrCSV);
-			
+
 			// ¹àÌÜ¿ô¤¬1°Ê²¼¤Î¾ì¹ç¤ÏÌµ»ë¤¹¤ë
 			if($max <= 1) {
-				continue;			
-			}
-			
+				continue;
+			}
+
 			// ¹àÌÜ¿ô¥Á¥§¥Ã¥¯
 			if($max != $colmax) {
@@ -109,14 +109,14 @@
 				$arrCSVErr = lfCheckError();
 			}
-			
+
 			// ÆþÎÏ¥¨¥é¡¼¥Á¥§¥Ã¥¯
 			if(count($arrCSVErr) > 0) {
 				echo "<font color=\"red\">¢£" . $line . "¹ÔÌÜ¤Ç¥¨¥é¡¼¤¬È¯À¸¤·¤Þ¤·¤¿¡£</font></br>\n";
 				foreach($arrCSVErr as $val) {
-					echo "<font color=\"red\">$val</font></br>\n";	
+					echo "<font color=\"red\">" . htmlspecialchars($val, ENT_QUOTES) . "</font></br>\n";
 				}
 				$err = true;
 			}
-			
+
 			if(!$err) {
 				lfRegistProduct($objQuery, $line);
@@ -124,10 +124,10 @@
 			}
 			$arrParam = $objFormParam->getHashArray();
- 
+
 			if(!$err) echo $line." / ".$rec_count. "¹ÔÌÜ¡¡¡Ê¾¦ÉÊID¡§".$arrParam['product_id']." / ¾¦ÉÊÌ¾¡§".$arrParam['name'].")\n<br />";
 			flush();
 		}
 		fclose($fp);
-		
+
 		if(!$err) {
 			$objQuery->commit();
@@ -140,10 +140,10 @@
 	} else {
 		foreach($arrErr as $val) {
-			echo "<font color=\"red\">$val</font></br>\n";	
+			echo "<font color=\"red\">$val</font></br>\n";
 		}
 	}
 	echo "<br/><a href=\"javascript:window.close()\">¢ªÊÄ¤¸¤ë</a>";
 	flush();
-	exit;	
+	exit;
 	break;
 default:
@@ -156,5 +156,5 @@
 //--------------------------------------------------------------------------------------------------------------------------
 
-/* 
+/*
  * ´Ø¿ôÌ¾¡§lfInitFile
  * ÀâÌÀ¡¡¡§¥Õ¥¡¥¤¥ë¾ðÊó¤Î½é´ü²½
@@ -164,5 +164,5 @@
 }
 
-/* 
+/*
  * ´Ø¿ôÌ¾¡§lfInitParam
  * ÀâÌÀ¡¡¡§ÆþÎÏ¾ðÊó¤Î½é´ü²½
@@ -170,11 +170,11 @@
 function lfInitParam() {
 	global $objFormParam;
-		
+
 	$objFormParam->addParam("¾¦ÉÊID", "product_id", INT_LEN, "n", array("MAX_LENGTH_CHECK","NUM_CHECK"));
 	$objFormParam->addParam("¾¦ÉÊµ¬³ÊID", "product_class_id", INT_LEN, "n", array("MAX_LENGTH_CHECK","NUM_CHECK"));
-	
+
 	$objFormParam->addParam("µ¬³ÊÌ¾1", "dummy1");
 	$objFormParam->addParam("µ¬³ÊÌ¾2", "dummy2");
-	
+
 	$objFormParam->addParam("¾¦ÉÊÌ¾", "name", STEXT_LEN, "KVa", array("EXIST_CHECK","SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¸ø³«¥Õ¥é¥°(1:¸ø³« 2:Èó¸ø³«)", "status", INT_LEN, "n", array("EXIST_CHECK","MAX_LENGTH_CHECK","NUM_CHECK"));
@@ -200,36 +200,36 @@
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö²èÁü(1)", "sub_image1", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö³ÈÂç²èÁü(1)", "sub_large_image1", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
-	
+
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥¿¥¤¥È¥ë(2)", "sub_title2", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥³¥á¥ó¥È(2)", "sub_comment2", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö²èÁü(2)", "sub_image2", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö³ÈÂç²èÁü(2)", "sub_large_image2", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
-	
+
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥¿¥¤¥È¥ë(3)", "sub_title3", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥³¥á¥ó¥È(3)", "sub_comment3", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö²èÁü(3)", "sub_image3", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö³ÈÂç²èÁü(3)", "sub_large_image3", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
-		
+
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥¿¥¤¥È¥ë(4)", "sub_title4", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥³¥á¥ó¥È(4)", "sub_comment4", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö²èÁü(4)", "sub_image4", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö³ÈÂç²èÁü(4)", "sub_large_image4", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
-		
+
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥¿¥¤¥È¥ë(5)", "sub_title5", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥³¥á¥ó¥È(5)", "sub_comment5", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö²èÁü(5)", "sub_image5", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
 	$objFormParam->addParam("¾ÜºÙ-¥µ¥Ö³ÈÂç²èÁü(5)", "sub_large_image5", LTEXT_LEN, "KVa", array("FILE_EXISTS","SPTAB_CHECK","MAX_LENGTH_CHECK"));
-	
+
 	$objFormParam->addParam("È¯Á÷ÆüÌÜ°Â", "deliv_date_id", INT_LEN, "n", array("MAX_LENGTH_CHECK","NUM_CHECK"));
-	
+
     for ($cnt = 1; $cnt <= RECOMMEND_PRODUCT_MAX; $cnt++) {
         $objFormParam->addParam("¤ª¤¹¤¹¤á¾¦ÉÊ($cnt)", "recommend_product_id$cnt", INT_LEN, "n", array("MAX_LENGTH_CHECK","NUM_CHECK"));
         $objFormParam->addParam("¾ÜºÙ-¥µ¥Ö¥³¥á¥ó¥È($cnt)", "recommend_comment$cnt", LTEXT_LEN, "KVa", array("SPTAB_CHECK","MAX_LENGTH_CHECK"));
     }
-    
+
 	$objFormParam->addParam("¾¦ÉÊ¥«¥Æ¥´¥ê", "category_id", STEXT_LEN, "n", array("EXIST_CHECK", "SPTAB_CHECK", "MAX_LENGTH_CHECK"));
 }
 
-/* 
+/*
  * ´Ø¿ôÌ¾¡§lfRegistProduct
  * °ú¿ô1 ¡§SC_Query¥ª¥Ö¥¸¥§¥¯¥È
@@ -239,5 +239,5 @@
 	global $objFormParam;
 	$arrRet = $objFormParam->getHashArray();
-	
+
 	// dtb_products°Ê³°¤ËÅÐÏ¿¤µ¤ì¤ëÃÍ¤ò½ü³°¤¹¤ë¡£
 	foreach($arrRet as $key => $val) {
@@ -274,14 +274,14 @@
 		$microtime = sprintf("%06d", $line);
 		$time .= ".$microtime";
-	}	
+	}
 	$sqlval['update_date'] = $time;
 	$sqlval['creator_id'] = $_SESSION['member_id'];
-		
+
 	if($sqlval['sale_limit'] == "") {
 		$sqlval['sale_unlimited'] = '1';
 	} else {
-		$sqlval['sale_unlimited'] = '0';		
-	}
-	
+		$sqlval['sale_unlimited'] = '0';
+	}
+
 	if($sqlval['status'] == "") {
 		$sqlval['status'] = 2;
@@ -312,18 +312,18 @@
             $product_id = $objQuery->get_auto_increment("dtb_products");
         }
-        
+
         $sqlval['product_id'] = $product_id;
 		$sqlval['create_date'] = $time;
-		
+
 		// ¥«¥Æ¥´¥êÆâ¤ÇºÇÂç¤Î¥é¥ó¥¯¤ò³ä¤êÅö¤Æ¤ë
 		$sqlval['rank'] = $objQuery->max("dtb_products", "rank", "category_id = ?", array($arrRet['category_id'])) + 1;
-		
+
 		// INSERT¤Î¼Â¹Ô
 		$objQuery->insert("dtb_products", $sqlval);
 	}
-	
+
 	// µ¬³ÊÅÐÏ¿
 	lfRegistProductClass($objQuery, $arrRet, $sqlval['product_id'], $arrRet['product_class_id']);
-	
+
 	// ¤ª¤¹¤¹¤á¾¦ÉÊÅÐÏ¿
 	$objQuery->delete("dtb_recommend_products", "product_id = ?", array($sqlval['product_id']));
@@ -347,5 +347,5 @@
 }
 
-/* 
+/*
  * ´Ø¿ôÌ¾¡§lfRegistProductClass
  * °ú¿ô1 ¡§SC_Query¥ª¥Ö¥¸¥§¥¯¥È
@@ -361,5 +361,5 @@
 		$sqlval['stock_unlimited'] = '1';
 	} else {
-		$sqlval['stock_unlimited'] = '0';		
+		$sqlval['stock_unlimited'] = '0';
 	}
 	$sqlval['price01'] = $arrList['price01'];
@@ -369,5 +369,5 @@
 		$sqlval['creator_id'] = '0';
 	}
-		
+
 	if($product_class_id == "") {
 		// ¿·µ¬ÅÐÏ¿
@@ -383,9 +383,9 @@
 		// ´ûÂ¸ÊÔ½¸
 		$where = "product_id = ? AND product_class_id = ?";
-		$objQuery->update("dtb_products_class", $sqlval, $where, array($product_id, $product_class_id));	
-	}
-}
-
-/* 
+		$objQuery->update("dtb_products_class", $sqlval, $where, array($product_id, $product_class_id));
+	}
+}
+
+/*
  * ´Ø¿ôÌ¾¡§lfCheckError
  * ÀâÌÀ¡¡¡§ÆþÎÏ¥Á¥§¥Ã¥¯
@@ -397,5 +397,5 @@
 	$objErr = new SC_CheckError($arrRet);
 	$objErr->arrErr = $objFormParam->checkError(false);
-	
+
 	if(count($objErr->arrErr) == 0) {
 		$objQuery = new SC_Query();
@@ -407,5 +407,5 @@
 			}
 		}
-				
+
 		if($arrRet['product_class_id'] != "") {
 			$count = 0;
@@ -417,5 +417,5 @@
 			}
 		}
-		
+
 		// Â¸ºß¤¹¤ë¥«¥Æ¥´¥êID¤«¥Á¥§¥Ã¥¯
 		$count = $objQuery->count("dtb_category", "category_id = ?", array($arrRet['category_id']));
@@ -427,5 +427,5 @@
 }
 
-/* 
+/*
  * ´Ø¿ôÌ¾¡§lfCSVRecordCount
  * ÀâÌÀ¡¡¡§CSV¤Î¥«¥¦¥ó¥È¿ô¤òÆÀ¤ë
@@ -433,5 +433,5 @@
  */
 function lfCSVRecordCount($file_name) {
-	
+
 	$count = 0;
 	$fp = fopen($file_name, "r");
@@ -440,5 +440,5 @@
 		$count++;
 	}
-	
+
 	return $count-1;
 }
