Changeset 82 for branches/1.1dev/lib/OrderStatus.inc.php

Timestamp:

Apr 8, 2006 3:07:57 AM (18 years ago)

Author:

scdev

Message:

Changed all usage of addslashes to mysql_real_escape_quotes

File:

• branches/1.1dev/lib/OrderStatus.inc.php (modified) (6 diffs)

branches/1.1dev/lib/OrderStatus.inc.php

@@ -18 +18 @@
 {
     if ($status != '') {
-        $whereclause = 'WHERE status = ' . addslashes($status);
+        $whereclause = 'WHERE status = ' . mysql_real_escape_string($status);
     } else {
         $whereclause = '';
@@ -52 +52 @@
     global $CFG, $_SESSION;
 
-    $qid = dbQuery("SELECT status, email, first_name, last_name FROM order_tbl WHERE order_id = " . addslashes($order_id));
+    $qid = dbQuery("SELECT status, email, first_name, last_name FROM order_tbl WHERE order_id = " . mysql_real_escape_string($order_id));
     if (mysql_num_rows($qid) == 1) {
     /* The order exists, we contine. */
@@ -105 +105 @@
         /* Otherwise we assume everything was updated okay and that 
          * we have a valid new status and so proceed updating the orders table. */
-        dbQuery("UPDATE order_tbl SET status = " . addslashes($db_update) . " WHERE order_id = " . addslashes($order_id));
+        dbQuery("UPDATE order_tbl SET status = " . mysql_real_escape_string($db_update) . " WHERE order_id = " . mysql_real_escape_string($order_id));
         
         if ($email_user == true) {
@@ -111 +111 @@
             
             /* Query to load the details of this order. */
-            $qid_order = dbQuery("SELECT * FROM order_tbl WHERE order_id = " . addslashes($order_id));
+            $qid_order = dbQuery("SELECT * FROM order_tbl WHERE order_id = " . mysql_real_escape_string($order_id));
             $order = mysql_fetch_assoc($qid_order);
 
@@ -129 +129 @@
                 LEFT JOIN product_tbl p
                 ON (oi.product_id = p.product_id)
-                WHERE oi.order_id = " . addslashes($order_id) . "
+                WHERE oi.order_id = " . mysql_real_escape_string($order_id) . "
             ");
             $item_num = 0;
@@ -214 +214 @@
 {  
     if ($polarity == '+' || $polarity == '-') {
-        $qid = dbQuery("SELECT product_id, qty as order_qty FROM order_items_tbl WHERE order_id = " . addslashes($order_id));
+        $qid = dbQuery("SELECT product_id, qty as order_qty FROM order_items_tbl WHERE order_id = " . mysql_real_escape_string($order_id));
         /* First we make sure each item is in stock in adequate quantities. */
         while ($order_item = mysql_fetch_assoc($qid)) {