Changeset 90 for branches/1.1dev/bin/module_maker/sql.cli.php

Timestamp:

Apr 8, 2006 8:35:17 AM (18 years ago)

Author:

scdev

Message:

changed addslashes to mysql_real_escape_string

File:

• branches/1.1dev/bin/module_maker/sql.cli.php (modified) (7 diffs)

branches/1.1dev/bin/module_maker/sql.cli.php

@@ -39 +39 @@
 
 // Get DB table column info.
-$qid = dbQuery("DESCRIBE " . addslashes($db_tbl));
+$qid = dbQuery("DESCRIBE " . mysql_real_escape_string($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
@@ -68 +68 @@
         } else if ('added_by_admin_id' == $field || 'modified_by_admin_id' == $field) {
             // Toggle types.
-            $c[$field] = "'\" . addslashes(\$_admin->getVal('user_id')) . \"'";
+            $c[$field] = "'\" . mysql_real_escape_string(\$_admin->getVal('user_id')) . \"'";
         } else if ('added_datetime' == $field || 'modified_datetime' == $field) {
             // DB record insertion datetime.
@@ -74 +74 @@
         } else {
             // Default. Just insert data.
-            $c[$field] = "'\" . addslashes(\$frm['$field']) . \"'";
+            $c[$field] = "'\" . mysql_real_escape_string(\$frm['$field']) . \"'";
         }
     }
@@ -127 +127 @@
         dbQuery("
             UPDATE $db_tbl SET$key_eq_val
-            WHERE $primary_key = '" . addslashes(\$frm['$primary_key']) . "'
+            WHERE $primary_key = '" . mysql_real_escape_string(\$frm['$primary_key']) . "'
         ");
 E_O_F;
@@ -140 +140 @@
 $delim = 'WHERE';
 if (!empty($primary_key)) {
-    $where_clause = "            $delim $primary_key = '\" . addslashes(\$frm['$primary_key']) . \"'\n";
+    $where_clause = "            $delim $primary_key = '\" . mysql_real_escape_string(\$frm['$primary_key']) . \"'\n";
     $delim = 'AND';
 }
@@ -147 +147 @@
         continue;
     }
-    $where_clause .= "            $delim $k = '\" . addslashes(\$frm['$k']) . \"'\n";
+    $where_clause .= "            $delim $k = '\" . mysql_real_escape_string(\$frm['$k']) . \"'\n";
     $delim = 'AND';
 }
@@ -175 +175 @@
 if (!isset($op) || 'search' == $op) {
 $search_skip_columns = array('added_datetime', 'added_by_admin_id', 'modified_datetime', 'modified_by_admin_id', 'publish', 'featured');
-$search_columns = $db_tbl . '.' . join(" LIKE '%\" . addslashes(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
+$search_columns = $db_tbl . '.' . join(" LIKE '%\" . mysql_real_escape_string(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
 echo <<<E_O_F
             \$where_clause .= (empty(\$where_clause) ? 'WHERE' : 'AND') . "
                 (
-                    $search_columns LIKE '%" . addslashes(\$qry_words[\$i]) . "%'
+                    $search_columns LIKE '%" . mysql_real_escape_string(\$qry_words[\$i]) . "%'
                 )
             ";