Changeset 90 for branches/1.1dev/bin/module_maker/skel/admin.php

Timestamp:

Apr 8, 2006 8:35:17 AM (18 years ago)

Author:

scdev

Message:

changed addslashes to mysql_real_escape_string

File:

• branches/1.1dev/bin/module_maker/skel/admin.php (modified) (6 diffs)

branches/1.1dev/bin/module_maker/skel/admin.php

@@ -138 +138 @@
         if (getFormdata('repeat', false)) {
             // Display edit function with next available ID.
-            $qid = dbQuery("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . addslashes(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
+            $qid = dbQuery("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . mysql_real_escape_string(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
             if (list($next_id) = mysql_fetch_row($qid)) {
                 dieURL($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $next_id);
@@ -204 +204 @@
             SELECT * 
             FROM %DB_TBL%
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
         ");
         if (!$frm = mysql_fetch_assoc($qid)) {
@@ -241 +241 @@
             SELECT <##> 
             FROM %DB_TBL%
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
         ");
         if (! list($name) = mysql_fetch_row($qid)) {
@@ -250 +250 @@
         
         // Delete the record.
-        dbQuery("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'");
+        dbQuery("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'");
         
         raiseMsg(sprintf(_("The %ITEM_TITLE% <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
@@ -320 +320 @@
     if (getFormData('filter_<##>', false)) {
         // Limit by filter.
-        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . addslashes(getFormData('filter_<##>')) . "'";
+        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . mysql_real_escape_string(getFormData('filter_<##>')) . "'";
     }
     
@@ -400 +400 @@
         dbQuery("
             UPDATE %DB_TBL% SET
-                rank = '" . addslashes($new_rank) . "'
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+                rank = '" . mysql_real_escape_string($new_rank) . "'
+            WHERE %PRIMARY_KEY% = '" . mysql_real_escape_string($id) . "'
         ");
     }