Changeset 82 for branches/1.1dev/lib/RecordLock.inc.php

Timestamp:

Apr 8, 2006 3:07:57 AM (18 years ago)

Author:

scdev

Message:

Changed all usage of addslashes to mysql_real_escape_quotes

File:

• branches/1.1dev/lib/RecordLock.inc.php (modified) (7 diffs)

branches/1.1dev/lib/RecordLock.inc.php

@@ -45 +45 @@
             $qid = dbQuery("
                 SELECT * FROM lock_tbl 
-                WHERE lock_id = '" . addslashes($record_table_or_lock_id) . "'
+                WHERE lock_id = '" . mysql_real_escape_string($record_table_or_lock_id) . "'
             ");
         } else {
@@ -51 +51 @@
             $qid = dbQuery("
                 SELECT * FROM lock_tbl 
-                WHERE record_table = '" . addslashes($record_table_or_lock_id) . "'
-                AND record_key = '" . addslashes($record_key) . "'
-                AND record_val = '" . addslashes($record_val) . "'
+                WHERE record_table = '" . mysql_real_escape_string($record_table_or_lock_id) . "'
+                AND record_key = '" . mysql_real_escape_string($record_key) . "'
+                AND record_val = '" . mysql_real_escape_string($record_val) . "'
             ");
         }
         if ($this->data = mysql_fetch_assoc($qid)) {
             // This could be integrated into the above query, but with the new auth system, this will be a $auth-> method call.
-//             $qid = dbQuery("SELECT username FROM admin_tbl WHERE admin_id = '" . addslashes($this->data['set_by_admin_id']) . "'");
+//             $qid = dbQuery("SELECT username FROM admin_tbl WHERE admin_id = '" . mysql_real_escape_string($this->data['set_by_admin_id']) . "'");
 //             list($this->data['editor']) = mysql_fetch_row($qid);
             $this->data['editor'] = $this->_auth->getUsername($this->data['set_by_admin_id']);
@@ -86 +86 @@
     {
         if (isset($this->data['lock_id'])) {
-            $qid = dbQuery("SELECT * FROM lock_tbl WHERE lock_id = '" . addslashes($this->data['lock_id']) . "'");
+            $qid = dbQuery("SELECT * FROM lock_tbl WHERE lock_id = '" . mysql_real_escape_string($this->data['lock_id']) . "'");
             if ($lock = mysql_fetch_assoc($qid)) {
                 return ($lock['set_by_admin_id'] == $this->_auth->getVal('user_id'));
@@ -112 +112 @@
         dbQuery("
             DELETE FROM lock_tbl 
-            WHERE record_table = '" . addslashes($record_table) . "'
-            AND record_key = '" . addslashes($record_key) . "'
-            AND record_val = '" . addslashes($record_val) . "'
+            WHERE record_table = '" . mysql_real_escape_string($record_table) . "'
+            AND record_key = '" . mysql_real_escape_string($record_key) . "'
+            AND record_val = '" . mysql_real_escape_string($record_val) . "'
         ");
         
@@ -127 +127 @@
                 lock_datetime
             ) VALUES (
-                '" . addslashes($record_table) . "',
-                '" . addslashes($record_key) . "',
-                '" . addslashes($record_val) . "',
-                '" . addslashes($title) . "',
-                '" . addslashes($this->_auth->getVal('user_id')) . "',
+                '" . mysql_real_escape_string($record_table) . "',
+                '" . mysql_real_escape_string($record_key) . "',
+                '" . mysql_real_escape_string($record_val) . "',
+                '" . mysql_real_escape_string($title) . "',
+                '" . mysql_real_escape_string($this->_auth->getVal('user_id')) . "',
                 NOW()
             )
@@ -151 +151 @@
         dbQuery("
             DELETE FROM lock_tbl 
-            WHERE lock_id = '" . addslashes($this->data['lock_id']) . "'
+            WHERE lock_id = '" . mysql_real_escape_string($this->data['lock_id']) . "'
         ");
     }
@@ -162 +162 @@
         if (isset($user_id)) {
             // Delete specific user's locks.
-            dbQuery("DELETE FROM lock_tbl WHERE set_by_admin_id = '" . addslashes($user_id) . "'");
+            dbQuery("DELETE FROM lock_tbl WHERE set_by_admin_id = '" . mysql_real_escape_string($user_id) . "'");
             logMsg(sprintf('Record locks owned by %s %s have been deleted', $this->_auth->getVal('auth_name'), $this->_auth->getUsername($user_id)), LOG_INFO, __FILE__, __LINE__);
         } else {