Changeset 111 for trunk/bin/module_maker/skel/admin.php

Timestamp:

Apr 27, 2006 1:49:54 AM (18 years ago)

Author:

scdev

Message:

Q - Finished depreciating addslashes. array_map instances need to use array('DB', 'escapeString') as first argument.

File:

• trunk/bin/module_maker/skel/admin.php (modified) (6 diffs)

trunk/bin/module_maker/skel/admin.php

@@ -146 +146 @@
         if (getFormdata('repeat', false)) {
             // Display edit function with next available ID.
-            $qid = DB::query("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . addslashes(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
+            $qid = DB::query("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . DB::escapeString(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
             if (list($next_id) = mysql_fetch_row($qid)) {
                 App::dieURL($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $next_id);
@@ -217 +217 @@
         SELECT *
         FROM %DB_TBL%
-        WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+        WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'
     ");
     if (!$frm = mysql_fetch_assoc($qid)) {
@@ -259 +259 @@
         SELECT <##>
         FROM %DB_TBL%
-        WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+        WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'
     ");
     if (! list($name) = mysql_fetch_row($qid)) {
@@ -268 +268 @@
 
     // Delete the record.
-    DB::query("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'");
+    DB::query("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'");
 
     App::raiseMsg(sprintf(_("The %ITEM_TITLE% <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
@@ -336 +336 @@
     if (getFormData('filter_<##>', false)) {
         // Limit by filter.
-        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . addslashes(getFormData('filter_<##>')) . "'";
+        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . DB::escapeString(getFormData('filter_<##>')) . "'";
     }
 
@@ -418 +418 @@
         DB::query("
             UPDATE %DB_TBL% SET
-                rank = '" . addslashes($new_rank) . "'
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+                rank = '" . DB::escapeString($new_rank) . "'
+            WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'
         ");
     }