Changeset 90

Timestamp:

Apr 8, 2006 8:35:17 AM (18 years ago)

Author:

scdev

Message:

changed addslashes to mysql_real_escape_string

Location:

branches/1.1dev

Files:

• bin/file_importer.php (modified) (1 diff)
• bin/module_maker/form_template.cli.php (modified) (1 diff)
• bin/module_maker/list_template.cli.php (modified) (1 diff)
• bin/module_maker/module.cli.php (modified) (1 diff)
• bin/module_maker/skel/admin.php (modified) (6 diffs)
• bin/module_maker/skel/public.php (modified) (2 diffs)
• bin/module_maker/sql.cli.php (modified) (7 diffs)
• bin/module_maker/validation.cli.php (modified) (1 diff)
• docs/file_layout.txt (modified) (1 diff)
• lib/Hierarchy.inc.php (modified) (9 diffs)

branches/1.1dev/bin/file_importer.php

@@ -43 +43 @@
 //                     added_datetime
 //                 ) VALUES (
-//                     '" . addslashes(0) . "',
-//                     '" . addslashes('hosting') . "',
-//                     '" . addslashes($file_date) . "',
-//                     '" . addslashes($amt[1]) . "',
-//                     '" . addslashes('Paid') . "',
-//                     '" . addslashes('') . "',
-//                     '" . addslashes($file_text) . "',
-//                     '" . addslashes($file_date) . "',
+//                     '" . mysql_real_escape_string(0) . "',
+//                     '" . mysql_real_escape_string('hosting') . "',
+//                     '" . mysql_real_escape_string($file_date) . "',
+//                     '" . mysql_real_escape_string($amt[1]) . "',
+//                     '" . mysql_real_escape_string('Paid') . "',
+//                     '" . mysql_real_escape_string('') . "',
+//                     '" . mysql_real_escape_string($file_text) . "',
+//                     '" . mysql_real_escape_string($file_date) . "',
 //                     NOW()
 //                 )

branches/1.1dev/bin/module_maker/form_template.cli.php

@@ -28 +28 @@
 
 // Get DB table column info.
-$qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
+$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;

branches/1.1dev/bin/module_maker/list_template.cli.php

@@ -40 +40 @@
 
 // Get DB table column info.
-$qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
+$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;

branches/1.1dev/bin/module_maker/module.cli.php

@@ -135 +135 @@
 // Ensure requested table contains columns.
 // Get DB table column info.
-$qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
+$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;

branches/1.1dev/bin/module_maker/skel/admin.php

@@ -138 +138 @@
         if (getFormdata('repeat', false)) {
             // Display edit function with next available ID.
-            $qid = dbQuery("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . addslashes(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
+            $qid = dbQuery("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
             if (list($next_id) = mysql_fetch_row($qid)) {
                 dieURL($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $next_id);
@@ -204 +204 @@
             SELECT * 
             FROM %DB_TBL%
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
         ");
         if (!$frm = mysql_fetch_assoc($qid)) {
@@ -241 +241 @@
             SELECT <##> 
             FROM %DB_TBL%
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
         ");
         if (! list($name) = mysql_fetch_row($qid)) {
@@ -250 +250 @@
         
         // Delete the record.
-        dbQuery("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'");
+        dbQuery("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'");
         
         raiseMsg(sprintf(_("The %ITEM_TITLE% <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
@@ -320 +320 @@
     if (getFormData('filter_<##>', false)) {
         // Limit by filter.
-        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . addslashes(getFormData('filter_<##>')) . "'";
+        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . mysql_real_escape_string(getFormData('filter_<##>')) . "'";
     }
     
@@ -400 +400 @@
         dbQuery("
             UPDATE %DB_TBL% SET
-                rank = '" . addslashes($new_rank) . "'
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+                rank = '" . mysql_real_escape_string($new_rank) . "'
+            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
         ");
     }

branches/1.1dev/bin/module_maker/skel/public.php

@@ -36 +36 @@
     $qid = dbQuery("
         SELECT * FROM %DB_TBL%
-        WHERE %PRIMARY_KEY% = '" . addslashes(getFormData('%PRIMARY_KEY%')) . "'
+        WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "'
         AND publish = 'true'
         <##>AND (publish_date <= CURDATE() OR publish_date = '0000-00-00')
@@ -50 +50 @@
         UPDATE %DB_TBL%
         SET hit_count = hit_count + 1
-        WHERE %PRIMARY_KEY% = '" . addslashes(getFormData('%PRIMARY_KEY%')) . "'
+        WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "'
     ");
         

branches/1.1dev/bin/module_maker/sql.cli.php

@@ -39 +39 @@
 
 // Get DB table column info.
-$qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
+$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
@@ -68 +68 @@
         } else if ('added_by_admin_id' == $field || 'modified_by_admin_id' == $field) {
             // Toggle types.
-            $c[$field] = "'\" . addslashes(\$_admin->getVal('user_id')) . \"'";
+            $c[$field] = "'\" . mysql_real_escape_string(\$_admin->getVal('user_id')) . \"'";
         } else if ('added_datetime' == $field || 'modified_datetime' == $field) {
             // DB record insertion datetime.
@@ -74 +74 @@
         } else {
             // Default. Just insert data.
-            $c[$field] = "'\" . addslashes(\$frm['$field']) . \"'";
+            $c[$field] = "'\" . mysql_real_escape_string(\$frm['$field']) . \"'";
         }
     }
@@ -127 +127 @@
         dbQuery("
             UPDATE $db_tbl SET$key_eq_val
-            WHERE $primary_key = '" . addslashes(\$frm['$primary_key']) . "'
+            WHERE $primary_key = '" . mysql_real_escape_string(\$frm['$primary_key']) . "'
         ");
 E_O_F;
@@ -140 +140 @@
 $delim = 'WHERE';
 if (!empty($primary_key)) {
-    $where_clause = "            $delim $primary_key = '\" . addslashes(\$frm['$primary_key']) . \"'\n";
+    $where_clause = "            $delim $primary_key = '\" . mysql_real_escape_string(\$frm['$primary_key']) . \"'\n";
     $delim = 'AND';
 }
@@ -147 +147 @@
         continue;
     }
-    $where_clause .= "            $delim $k = '\" . addslashes(\$frm['$k']) . \"'\n";
+    $where_clause .= "            $delim $k = '\" . mysql_real_escape_string(\$frm['$k']) . \"'\n";
     $delim = 'AND';
 }
@@ -175 +175 @@
 if (!isset($op) || 'search' == $op) {
 $search_skip_columns = array('added_datetime', 'added_by_admin_id', 'modified_datetime', 'modified_by_admin_id', 'publish', 'featured');
-$search_columns = $db_tbl . '.' . join(" LIKE '%\" . addslashes(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
+$search_columns = $db_tbl . '.' . join(" LIKE '%\" . mysql_real_escape_string(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
 echo <<<E_O_F
             \$where_clause .= (empty(\$where_clause) ? 'WHERE' : 'AND') . "
                 (
-                    $search_columns LIKE '%" . addslashes(\$qry_words[\$i]) . "%'
+                    $search_columns LIKE '%" . mysql_real_escape_string(\$qry_words[\$i]) . "%'
                 )
             ";

branches/1.1dev/bin/module_maker/validation.cli.php

@@ -29 +29 @@
 
 // Get DB table column info.
-$qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
+$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;

branches/1.1dev/docs/file_layout.txt

@@ -16 +16 @@
         FormValidator.inc.php (validation routines used to test incoming user data.)
         ImageThumb.inc.php (automated image thumbnailing routines.)
-        NodeHeirarchy.php (class for manipulation of node heirarchies.)
+        Hierarchy.php (class for manipulation of node heirarchies.)
         MySQLSessionHandler.inc.php (database session handler.)
         Nav.inc.php (navigation element management class))

branches/1.1dev/lib/Hierarchy.inc.php

@@ -1 +1 @@
 <?php
 /**
- * Heirarchy.inc.php 
+ * Hierarchy.inc.php 
  * Code by Strangecode :: www.strangecode.com :: This document contains copyrighted information
  */
@@ -7 +7 @@
 /**
  * Objective: This class provides the tools to organize pieces of data into a
- * heirarchy of nodes. Any form of data (article, product, image) can be
- * represented as a node in this heirarchy. This class does not manipulate the
+ * hierarchy of nodes. Any form of data (article, product, image) can be
+ * represented as a node in this hierarchy. This class does not manipulate the
  * data, nor is it involved in storing or retrieving the data. In fact it does
  * not access the tables where data exists and cannot find out info about the
  * data. You must provide identification of a piece of data (type and ID) to
- * insert it into the heirarchy. The node heirarchy is completely
+ * insert it into the hierarchy. The node hierarchy is completely
  * separate from data storage and retreival. You must separatly store the data
  * using whatever logic is specific to the data then also call these functions.
  * Nodes are not the data. The nodes are mere singularities in virtual space
- * that represent a piece of data's relationship with another. The heirarchy
+ * that represent a piece of data's relationship with another. The hierarchy
  * is an inverted tree structure. Each node can have virtually infinite
  * children. Each child can have multiple parents.
@@ -29 +29 @@
 require_once dirname(__FILE__) . '/Utilities.inc.php';
 
-class Heirarchy {
+class Hierarchy {
 
     /**
@@ -67 +67 @@
      *                          configuration or connection parameters.
      */
-    function Heirarchy($params=array())
+    function Hierarchy($params=array())
     {
         $this->params = $params;
@@ -128 +128 @@
     
     /**
-     * Takes a singlar node identifier and returns it as components of an array.
+     * Takes a singular node identifier and returns it as components of an array.
      * @param string    $node
      * @return mixed    Array of node type and id on success, false on failure.
@@ -547 +547 @@
      * the specified node IS an ancestor of a node made into it's parent, we would
      * have a circular reference that would cause an infinite loop with any
-     * recursive queries of the heirarchy.
+     * recursive queries of the hierarchy.
      * @param  string    $child_type
      * @param  string    $child_id
@@ -573 +573 @@
      * ALL ancestors to the specified node. I'm not sure what the order will be
      * but that probably isn't useful anyways. I use this to prevent circular
-     * references in the heirarchy.
+     * references in the hierarchy.
      * @param  string    $child_type
      * @param  string    $child_id
@@ -712 +712 @@
             for ($i=0; $i<$num_children; $i++) {
 
-                $row = $my_children[$i];
-                // Preventing circular references.
-                if ($row['child_type'] == $child_type && $row['child_id'] == $child_id) {
-                    logMsg(sprintf(_("Circular reference detected: %s has itself as a parent."), $this->toStringID($row['child_type'], $row['child_id'])), LOG_ERR, __FILE__, __LINE__);
+                // Preventing circular references (Except when including current  item in list).
+                if ($my_children[$i]['child_type'] == $child_type && $my_children[$i]['child_id'] == $child_id && !($_return_flag && $include_curr)) {
+                    logMsg(sprintf(_("Circular reference detected: %s has itself as a parent."), $this->toStringID($my_children[$i]['child_type'], $my_children[$i]['child_id'])), LOG_ERR, __FILE__, __LINE__);
                     continue;
                 }
-                $row['indent'] = $_indent;
-                if (in_array($this->toStringID($row['child_type'], $row['child_id']), $preselected)) {
-                    $row['selected'] = true;
+                
+                $my_children[$i]['indent'] = $_indent;
+
+                if (in_array($this->toStringID($my_children[$i]['child_type'], $my_children[$i]['child_id']), $preselected)) {
+                    $my_children[$i]['selected'] = true;
                 }
-                $output[] = $row;
-                unset($row);
+
+                $output[] = $my_children[$i];
                 
-                // This is so we test if each node is a string only once. We store the result in the is_a_leaf array statically.
+                // Test if each node is a string only once. Store the result in the is_a_leaf array statically.
                 if (!isset($is_a_leaf[$this->toStringID($my_children[$i]['child_type'], $my_children[$i]['child_id'])])) {
                     $is_a_leaf[$this->toStringID($my_children[$i]['child_type'], $my_children[$i]['child_id'])] = $this->isLeaf($my_children[$i]['child_type'], $my_children[$i]['child_id']);
                 }
                 if (!$is_a_leaf[$this->toStringID($my_children[$i]['child_type'], $my_children[$i]['child_id'])]) {
-                    // If this node is not a leaf, we dive into it recursivly.
+                    // If this node is not a leaf, we dive into it recursively.
                     $this->getNodeList($preselected, $my_children[$i]['child_type'], $my_children[$i]['child_id'], $type_constraint, $include_curr, $order, $_indent+1, false);
                 }
@@ -747 +748 @@
     }
     
+    function convertListToTree($curr, $child_type=null, $child_id=null, $_return_flag=true)
+    {
+        if (!is_array($curr) || empty($curr)) {
+            return array();
+        }
+
+        static $orig;
+        static $children_map;
+        static $node_map;
+        
+        // The original $curr contains the full list. Save a copy of this.
+        if (!isset($orig)) {
+            $orig = $curr;
+
+            // Create children map, a dictionary of Parent IDs -> Children IDs.
+            $children_map = array();
+            foreach ($orig as $i => $n) {
+                $n_parent = $this->toStringID($n['parent_type'], $n['parent_id']);
+                $n_child = $this->toStringID($n['child_type'], $n['child_id']);
+                $children_map[$n_parent][] = $n_child;
+            }
+
+            // Create node array map, a dictionary of $orig keys -> node IDs.
+            $node_map = array();
+            foreach ($orig as $i => $n) {
+                $n_child = $this->toStringID($n['child_type'], $n['child_id']);
+                $node_map[$n_child] = $i;
+            }
+            
+            // Set initial (root) node.
+            if (isset($child_type) && isset($child_id)) {
+                // Use provided node as starting point.
+                $curr = $orig[$node_map[$this->toStringID($child_type, $child_id)]];
+            } else {
+                // Otherwise assume first element of orig is starting point.
+                $curr = $orig[0];
+            }
+        }
+        
+        // Get children of current node.
+        $curr_str_id = $this->toStringID($curr['child_type'], $curr['child_id']);
+        $curr_children = $children_map[$curr_str_id];
+        
+        // If any children, recurse in appending a multidimensional array to $curr.
+        if (!empty($curr_children)) {
+            foreach ($curr_children as $child) {
+                $curr['children'][] = $this->convertListToTree($orig[$node_map[$child]], null, null, false);
+            }
+        }
+        
+        if ($_return_flag) {
+            // We must reset the static variables so that they do
+            // not fill up during subsequent function calls.
+            $orig = null;
+            $children_map = null;
+            $node_map = null;
+            return array($curr);
+        }
+
+        return $curr;
+    }
+
+    function printTree($in)
+    {
+        if (!is_array($in) || empty($in)) {
+            return false;
+        }
+
+        ?><ul><?php
+        foreach ($in as $n) {
+            $class = $n['selected'] ? ' class="current"' : '';
+            ?><li<?php echo $class; ?>><?php
+            echo oTxt($n['title']);
+            if (isset($n['children']) && !empty($n['children'])) {
+                $this->printTree($n['children']);
+            }
+            ?></li><?php
+        }
+        ?></ul><?php
+    }
     
     /**