Changeset 90 for branches/1.1dev/bin


Ignore:
Timestamp:
Apr 8, 2006 8:35:17 AM (18 years ago)
Author:
scdev
Message:

changed addslashes to mysql_real_escape_string

Location:
branches/1.1dev/bin
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • branches/1.1dev/bin/file_importer.php

    r89 r90  
    4343//                     added_datetime
    4444//                 ) VALUES (
    45 //                     '" . addslashes(0) . "',
    46 //                     '" . addslashes('hosting') . "',
    47 //                     '" . addslashes($file_date) . "',
    48 //                     '" . addslashes($amt[1]) . "',
    49 //                     '" . addslashes('Paid') . "',
    50 //                     '" . addslashes('') . "',
    51 //                     '" . addslashes($file_text) . "',
    52 //                     '" . addslashes($file_date) . "',
     45//                     '" . mysql_real_escape_string(0) . "',
     46//                     '" . mysql_real_escape_string('hosting') . "',
     47//                     '" . mysql_real_escape_string($file_date) . "',
     48//                     '" . mysql_real_escape_string($amt[1]) . "',
     49//                     '" . mysql_real_escape_string('Paid') . "',
     50//                     '" . mysql_real_escape_string('') . "',
     51//                     '" . mysql_real_escape_string($file_text) . "',
     52//                     '" . mysql_real_escape_string($file_date) . "',
    5353//                     NOW()
    5454//                 )

  • branches/1.1dev/bin/module_maker/form_template.cli.php

    r89 r90  
    2828
    2929// Get DB table column info.
    30 $qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
     30$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
    3131while ($row = mysql_fetch_row($qid)) {
    3232    $cols[] = $row;

  • branches/1.1dev/bin/module_maker/list_template.cli.php

    r89 r90  
    4040
    4141// Get DB table column info.
    42 $qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
     42$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
    4343while ($row = mysql_fetch_row($qid)) {
    4444    $cols[] = $row;

  • branches/1.1dev/bin/module_maker/module.cli.php

    r89 r90  
    135135// Ensure requested table contains columns.
    136136// Get DB table column info.
    137 $qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
     137$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
    138138while ($row = mysql_fetch_row($qid)) {
    139139    $cols[] = $row;

  • branches/1.1dev/bin/module_maker/skel/admin.php

    r89 r90  
    138138        if (getFormdata('repeat', false)) {
    139139            // Display edit function with next available ID.
    140             $qid = dbQuery("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . addslashes(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
     140            $qid = dbQuery("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
    141141            if (list($next_id) = mysql_fetch_row($qid)) {
    142142                dieURL($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $next_id);
    … …  
    204204            SELECT *
    205205            FROM %DB_TBL%
    206             WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
     206            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
    207207        ");
    208208        if (!$frm = mysql_fetch_assoc($qid)) {
    … …  
    241241            SELECT <##>
    242242            FROM %DB_TBL%
    243             WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
     243            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
    244244        ");
    245245        if (! list($name) = mysql_fetch_row($qid)) {
    … …  
    250250       
    251251        // Delete the record.
    252         dbQuery("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'");
     252        dbQuery("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'");
    253253       
    254254        raiseMsg(sprintf(_("The %ITEM_TITLE% <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
    … …  
    320320    if (getFormData('filter_<##>', false)) {
    321321        // Limit by filter.
    322         $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . addslashes(getFormData('filter_<##>')) . "'";
     322        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . mysql_real_escape_string(getFormData('filter_<##>')) . "'";
    323323    }
    324324   
    … …  
    400400        dbQuery("
    401401            UPDATE %DB_TBL% SET
    402                 rank = '" . addslashes($new_rank) . "'
    403             WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
     402                rank = '" . mysql_real_escape_string($new_rank) . "'
     403            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
    404404        ");
    405405    }

  • branches/1.1dev/bin/module_maker/skel/public.php

    r89 r90  
    3636    $qid = dbQuery("
    3737        SELECT * FROM %DB_TBL%
    38         WHERE %PRIMARY_KEY% = '" . addslashes(getFormData('%PRIMARY_KEY%')) . "'
     38        WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "'
    3939        AND publish = 'true'
    4040        <##>AND (publish_date <= CURDATE() OR publish_date = '0000-00-00')
    … …  
    5050        UPDATE %DB_TBL%
    5151        SET hit_count = hit_count + 1
    52         WHERE %PRIMARY_KEY% = '" . addslashes(getFormData('%PRIMARY_KEY%')) . "'
     52        WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "'
    5353    ");
    5454       

  • branches/1.1dev/bin/module_maker/sql.cli.php

    r89 r90  
    3939
    4040// Get DB table column info.
    41 $qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
     41$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
    4242while ($row = mysql_fetch_row($qid)) {
    4343    $cols[] = $row;
    … …  
    6868        } else if ('added_by_admin_id' == $field || 'modified_by_admin_id' == $field) {
    6969            // Toggle types.
    70             $c[$field] = "'\" . addslashes(\$_admin->getVal('user_id')) . \"'";
     70            $c[$field] = "'\" . mysql_real_escape_string(\$_admin->getVal('user_id')) . \"'";
    7171        } else if ('added_datetime' == $field || 'modified_datetime' == $field) {
    7272            // DB record insertion datetime.
    … …  
    7474        } else {
    7575            // Default. Just insert data.
    76             $c[$field] = "'\" . addslashes(\$frm['$field']) . \"'";
     76            $c[$field] = "'\" . mysql_real_escape_string(\$frm['$field']) . \"'";
    7777        }
    7878    }
    … …  
    127127        dbQuery("
    128128            UPDATE $db_tbl SET$key_eq_val
    129             WHERE $primary_key = '" . addslashes(\$frm['$primary_key']) . "'
     129            WHERE $primary_key = '" . mysql_real_escape_string(\$frm['$primary_key']) . "'
    130130        ");
    131131E_O_F;
    … …  
    140140$delim = 'WHERE';
    141141if (!empty($primary_key)) {
    142     $where_clause = "            $delim $primary_key = '\" . addslashes(\$frm['$primary_key']) . \"'\n";
     142    $where_clause = "            $delim $primary_key = '\" . mysql_real_escape_string(\$frm['$primary_key']) . \"'\n";
    143143    $delim = 'AND';
    144144}
    … …  
    147147        continue;
    148148    }
    149     $where_clause .= "            $delim $k = '\" . addslashes(\$frm['$k']) . \"'\n";
     149    $where_clause .= "            $delim $k = '\" . mysql_real_escape_string(\$frm['$k']) . \"'\n";
    150150    $delim = 'AND';
    151151}
    … …  
    175175if (!isset($op) || 'search' == $op) {
    176176$search_skip_columns = array('added_datetime', 'added_by_admin_id', 'modified_datetime', 'modified_by_admin_id', 'publish', 'featured');
    177 $search_columns = $db_tbl . '.' . join(" LIKE '%\" . addslashes(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
     177$search_columns = $db_tbl . '.' . join(" LIKE '%\" . mysql_real_escape_string(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
    178178echo <<<E_O_F
    179179            \$where_clause .= (empty(\$where_clause) ? 'WHERE' : 'AND') . "
    180180                (
    181                     $search_columns LIKE '%" . addslashes(\$qry_words[\$i]) . "%'
     181                    $search_columns LIKE '%" . mysql_real_escape_string(\$qry_words[\$i]) . "%'
    182182                )
    183183            ";

  • branches/1.1dev/bin/module_maker/validation.cli.php

    r89 r90  
    2929
    3030// Get DB table column info.
    31 $qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
     31$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
    3232while ($row = mysql_fetch_row($qid)) {
    3333    $cols[] = $row;
Note: See TracChangeset for help on using the changeset viewer.