Changeset 111 for trunk/lib/Auth_SQL.inc.php

Timestamp:

Apr 27, 2006 1:49:54 AM (18 years ago)

Author:

scdev

Message:

Q - Finished depreciating addslashes. array_map instances need to use array('DB', 'escapeString') as first argument.

File:

• trunk/lib/Auth_SQL.inc.php (modified) (9 diffs)

trunk/lib/Auth_SQL.inc.php

@@ -305 +305 @@
             SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . addslashes($username) . "'
-            AND BINARY userpass = '" . addslashes($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
+            AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
         ");
 
@@ -453 +453 @@
             $qid = DB::query("
                 SELECT 1 FROM " . $this->_params['db_table'] . "
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
                 AND DATE_ADD(last_login_datetime, INTERVAL '" . $this->_params['login_timeout'] . "' SECOND) > NOW()
                 AND DATE_ADD(last_access_datetime, INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND) > NOW()
@@ -572 +572 @@
 
         if ($this->getParam('blocking')) {
-            if (strlen(addslashes($reason)) > 255) {
+            if (strlen(DB::escapeString($reason)) > 255) {
                 // blocked_reason field is varchar(255).
                 App::logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
@@ -582 +582 @@
                 UPDATE " . $this->_params['db_table'] . " SET
                 blocked = 'true',
-                blocked_reason = '" . addslashes($reason) . "'
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                blocked_reason = '" . DB::escapeString($reason) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
             ");
         }
@@ -602 +602 @@
                 blocked = '',
                 blocked_reason = ''
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
             ");
         }
@@ -620 +620 @@
             SELECT 1
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . addslashes($username) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
         ");
         return (mysql_num_rows($qid) > 0);
@@ -638 +638 @@
             SELECT " . $this->_params['db_username_column'] . "
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
         if (list($username) = mysql_fetch_row($qid)) {
@@ -717 +717 @@
         DB::query("
             UPDATE " . $this->_params['db_table'] . "
-            SET userpass = '" . addslashes($this->encryptPassword($password)) . "'
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            SET userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
     }
@@ -739 +739 @@
         $qid = DB::query("
             SELECT * FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
         if (!$user_data = mysql_fetch_assoc($qid)) {