Changeset 111 for trunk/services

Timestamp:

Apr 27, 2006 1:49:54 AM (18 years ago)

Author:

scdev

Message:

Q - Finished depreciating addslashes. array_map instances need to use array('DB', 'escapeString') as first argument.

File:

• trunk/services/admins.php (modified) (7 diffs)

trunk/services/admins.php

@@ -154 +154 @@
         if (getFormdata('repeat', false)) {
             // Display edit function with next available ID.
-            $qid = DB::query("SELECT admin_id FROM admin_tbl WHERE admin_id > '" . addslashes(getFormData('admin_id')) . "' ORDER BY admin_id ASC LIMIT 1");
+            $qid = DB::query("SELECT admin_id FROM admin_tbl WHERE admin_id > '" . DB::escapeString(getFormData('admin_id')) . "' ORDER BY admin_id ASC LIMIT 1");
             if (list($next_id) = mysql_fetch_row($qid)) {
                 App::dieURL($_SERVER['PHP_SELF'] . '?op=edit&admin_id=' . $next_id);
@@ -268 +268 @@
         SELECT *
         FROM admin_tbl
-        WHERE admin_id = '" . addslashes($id) . "'
+        WHERE admin_id = '" . DB::escapeString($id) . "'
     ");
     if (!$frm = mysql_fetch_assoc($qid)) {
@@ -325 +325 @@
     $qid = DB::query("
         SELECT username, user_type from admin_tbl
-        WHERE admin_id = '" . addslashes($id) . "'
+        WHERE admin_id = '" . DB::escapeString($id) . "'
     ");
     if (! list($name, $user_type) = mysql_fetch_row($qid)) {
@@ -347 +347 @@
     } else {
         // Delete the record.
-        DB::query("DELETE FROM admin_tbl WHERE admin_id = '" . addslashes($id) . "'");
+        DB::query("DELETE FROM admin_tbl WHERE admin_id = '" . DB::escapeString($id) . "'");
         App::raiseMsg(sprintf(_("The admin <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
     }
@@ -373 +373 @@
             added_datetime
         ) VALUES (
-            '" . addslashes($frm['username']) . "',
-            '" . addslashes($frm['first_name']) . "',
-            '" . addslashes($frm['last_name']) . "',
-            '" . addslashes($frm['email']) . "',
-            '" . addslashes($frm['user_type']) . "',
-            '" . addslashes($auth->getVal('user_id')) . "',
+            '" . DB::escapeString($frm['username']) . "',
+            '" . DB::escapeString($frm['first_name']) . "',
+            '" . DB::escapeString($frm['last_name']) . "',
+            '" . DB::escapeString($frm['email']) . "',
+            '" . DB::escapeString($frm['user_type']) . "',
+            '" . DB::escapeString($auth->getVal('user_id')) . "',
             NOW()
         )
@@ -417 +417 @@
     DB::query("
         UPDATE admin_tbl SET
-            username = '" . addslashes($frm['username']) . "',
-            first_name = '" . addslashes($frm['first_name']) . "',
-            last_name = '" . addslashes($frm['last_name']) . "',
-            email = '" . addslashes($frm['email']) . "',
-            user_type = '" . addslashes($frm['user_type']) . "',
-            modified_by_user_id = '" . addslashes($auth->getVal('user_id')) . "',
+            username = '" . DB::escapeString($frm['username']) . "',
+            first_name = '" . DB::escapeString($frm['first_name']) . "',
+            last_name = '" . DB::escapeString($frm['last_name']) . "',
+            email = '" . DB::escapeString($frm['email']) . "',
+            user_type = '" . DB::escapeString($frm['user_type']) . "',
+            modified_by_user_id = '" . DB::escapeString($auth->getVal('user_id')) . "',
             modified_datetime = NOW()
-        WHERE admin_id = '" . addslashes($frm['admin_id']) . "'
+        WHERE admin_id = '" . DB::escapeString($frm['admin_id']) . "'
     ");
 
@@ -450 +450 @@
             $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . "
                 (
-                    admin_tbl.username LIKE '%" . addslashes($qry_words[$i]) . "%'
-                    OR admin_tbl.first_name LIKE '%" . addslashes($qry_words[$i]) . "%'
-                    OR admin_tbl.last_name LIKE '%" . addslashes($qry_words[$i]) . "%'
-                    OR admin_tbl.email LIKE '%" . addslashes($qry_words[$i]) . "%'
+                    admin_tbl.username LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
+                    OR admin_tbl.first_name LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
+                    OR admin_tbl.last_name LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
+                    OR admin_tbl.email LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
                 )
             ";