Changeset 82 for branches/1.1dev/lib/AuthSQL.inc.php

Timestamp:

Apr 8, 2006 3:07:57 AM (18 years ago)

Author:

scdev

Message:

Changed all usage of addslashes to mysql_real_escape_quotes

File:

• branches/1.1dev/lib/AuthSQL.inc.php (modified) (10 diffs)

branches/1.1dev/lib/AuthSQL.inc.php

@@ -185 +185 @@
             SELECT *, " . $this->_params['user_id_column'] . " AS user_id 
             FROM " . $this->_params['user_tbl'] . "
-            WHERE BINARY username = '" . addslashes($username) . "'
-            AND BINARY userpass = '" . addslashes($this->encryptPassword($password)) . "'
+            WHERE BINARY username = '" . mysql_real_escape_string($username) . "'
+            AND BINARY userpass = '" . mysql_real_escape_string($this->encryptPassword($password)) . "'
         ");
         
@@ -331 +331 @@
             $qid = dbQuery("
                 SELECT 1 FROM " . $this->_params['user_tbl'] . "
-                WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
                 AND DATE_ADD(last_login_datetime, INTERVAL '" . $this->_params['login_timeout'] . "' SECOND) > NOW()
                 AND DATE_ADD(last_access_datetime, INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND) > NOW()
@@ -444 +444 @@
     {
         if ($this->getFeature('blocking')) {
-            if (strlen(addslashes($reason)) > 255) {
+            if (strlen(mysql_real_escape_string($reason)) > 255) {
                 // blocked_reason field is varchar(255).
                 logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
@@ -454 +454 @@
                 UPDATE " . $this->_params['user_tbl'] . " SET
                 blocked = 'true',
-                blocked_reason = '" . addslashes($reason) . "'
-                WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'
+                blocked_reason = '" . mysql_real_escape_string($reason) . "'
+                WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
             ");
         }
@@ -472 +472 @@
                 blocked = '',
                 blocked_reason = ''
-                WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
             ");
         }
@@ -486 +486 @@
     function usernameExists($username)
     {   
-        $qid = dbQuery("SELECT 1 FROM " . $this->_params['user_tbl'] . " WHERE username = '" . addslashes($username) . "'");
+        $qid = dbQuery("SELECT 1 FROM " . $this->_params['user_tbl'] . " WHERE username = '" . mysql_real_escape_string($username) . "'");
         return (mysql_num_rows($qid) > 0);
     }
@@ -499 +499 @@
     function getUsername($user_id)
     {   
-        $qid = dbQuery("SELECT " . $this->_params['username_column'] . " FROM " . $this->_params['user_tbl'] . " WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'");
+        $qid = dbQuery("SELECT " . $this->_params['username_column'] . " FROM " . $this->_params['user_tbl'] . " WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'");
         if (list($username) = mysql_fetch_row($qid)) {
             return $username;
@@ -577 +577 @@
         dbQuery("
             UPDATE " . $this->_params['user_tbl'] . " 
-            SET userpass = '" . addslashes($this->encryptPassword($password)) . "'
-            WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'
+            SET userpass = '" . mysql_real_escape_string($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
         ");
     }
@@ -600 +600 @@
         $qid = dbQuery("
             SELECT * FROM " . $this->_params['user_tbl'] . "
-            WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
         ");
         $user_data = mysql_fetch_assoc($qid);
@@ -610 +610 @@
         dbQuery("
             UPDATE " . $this->_params['user_tbl'] . " 
-            SET userpass = '" . addslashes($this->encryptPassword($password)) . "'
-            WHERE " . $this->_params['user_id_column'] . " = '" . addslashes($user_id) . "'
+            SET userpass = '" . mysql_real_escape_string($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
         ");