Opensource.Platon.SK CVS: Metafox/db.inc.php - diff

Up to [Platon] / Metafox

Diff for Metafox/db.inc.php between version 1.35 and 1.36

version 1.35, 2007/02/24 21:47:21

version 1.36, 2007/02/24 23:43:49

Line 17

* http://platon.sk/projects/Metafox/

/* $Platon: Metafox/db.inc.php,v 1.34 2007-02-24 21:11:02 nepto Exp $ */

/* $Platon: Metafox/db.inc.php,v 1.35 2007-02-24 21:47:21 nepto Exp $ */

* updates: 23/5/2001, 29/7/2001, 11/10/2001, 2/11/2001, 11/1/2002, 23/7/2002

Line 34 require_once 'db-core/db-core.inc.php';

* ezin_validate_IDs()

* TODO: replace addslashes() by mysql_escape_string()

function ezin_validate_IDs($ar) /* {{{ */

{

Line 73 function ezin_validate_IDs($ar) /* {{{ *

Line 72 function ezin_validate_IDs($ar) /* {{{ *

if (intval($ar['author_id']) > 0) {

$conditions[] = $ezin_authors.'.id = '.intval($ar['author_id']);

} else {

$conditions[] = $ezin_authors.'.access_key = "'.addslashes($ar['author_id']).'"';

$conditions[] = $ezin_authors.'.access_key = "'.ezin_db_escape($ar['author_id']).'"';

}

} else {

Line 109 function ezin_validate_IDs($ar) /* {{{ *

Line 108 function ezin_validate_IDs($ar) /* {{{ *

if (intval($ar['article_id']) > 0) {

$conditions[] = $ezin_articles.'.id = '.intval($ar['article_id']);

} else {

$conditions[] = $ezin_articles.'.access_key = "'.addslashes($ar['article_id']).'"';

$conditions[] = $ezin_articles.'.access_key = "'.ezin_db_escape($ar['article_id']).'"';

}

$id_included = 1;

}

Line 119 function ezin_validate_IDs($ar) /* {{{ *

Line 118 function ezin_validate_IDs($ar) /* {{{ *

if (intval($ar['section_id']) > 0) {

$conditions[] = $ezin_sections.'.id = '.intval($ar['section_id']);

} else {

$conditions[] = $ezin_sections.'.access_key = "'.addslashes($ar['section_id']).'"';

$conditions[] = $ezin_sections.'.access_key = "'.ezin_db_escape($ar['section_id']).'"';

}

$id_included = 1;

}

Line 244 function ezin_get_section_list($lang = '

Line 243 function ezin_get_section_list($lang = '

.' WHERE type IN ("normal", "global")';

if ($lang != '') {

$query .= ' AND (lang IS NULL OR lang = ""'

.' OR lang LIKE "'.addslashes($lang).'")';

.' OR lang LIKE "'.ezin_db_escape($lang).'")';

}

$query .= ' ORDER BY ord ASC, type ASC, id ASC';

$result = @mysql_query($query, $ezin_db_handle)

Line 267 function ezin_get_section_list_counts($l

Line 266 function ezin_get_section_list_counts($l

.' WHERE type IN ("normal", "global")';

if ($lang != '') {

$query .= ' AND (lang IS NULL OR lang = ""'

.' OR lang LIKE "'.addslashes($lang).'")';

.' OR lang LIKE "'.ezin_db_escape($lang).'")';

}

$query .= ' ORDER BY ord ASC, type ASC, id ASC';

$result = @mysql_query($query, $ezin_db_handle)

Line 411 function ezin_get_article_list($section_

Line 410 function ezin_get_article_list($section_

.' AND sections.type NOT IN ("", "full_hidden", "disabled")';

if ($lang != '') {

$query .= ' AND (lang IS NULL OR lang = ""'

.' OR lang LIKE "'.addslashes($lang).'")';

.' OR lang LIKE "'.ezin_db_escape($lang).'")';

}

if (strlen($author_id) > 0) {

if (is_numeric($author_id)) {

Line 419 function ezin_get_article_list($section_

Line 418 function ezin_get_article_list($section_

$query .= ' AND authors.id = '.intval($author_id);

}

} else {

$query .= ' AND authors.name LIKE "%'.addslashes($author_id).'%"';

$query .= ' AND authors.name LIKE "%'.ezin_db_escape($author_id).'%"';

}

} else {

$query .= ' AND articles.status NOT IN ("hidden")';

Line 470 function ezin_get_article_list_counts($s

Line 469 function ezin_get_article_list_counts($s

.' AND sections.type NOT IN ("", "full_hidden", "disabled")';

if ($lang != '') {

$query .= ' AND (lang IS NULL OR lang = ""'

.' OR lang LIKE "'.addslashes($lang).'")';

.' OR lang LIKE "'.ezin_db_escape($lang).'")';

}

if (strlen($author_id) > 0) {

if (is_numeric($author_id)) {

$query .= ' AND authors.id = '.intval($author_id);

} else {

$query .= ' AND authors.name LIKE "%'.addslashes($author_id).'%"';

$query .= ' AND authors.name LIKE "%'.ezin_db_escape($author_id).'%"';

}

} else {

$query .= ' AND articles.status NOT IN ("hidden")';

Line 620 function ezin_save_author($data) /* {{{

Line 619 function ezin_save_author($data) /* {{{

global $ezin_sys, $ezin_cfg;

global $ezin_db_handle;

$escape_function = function_exists('mysql_escape_string')

? 'mysql_escape_string'

: 'addslashes';

foreach (array_keys($data) as $key) {

$data[$key] = $escape_function($data[$key]);

}

$query = sprintf('SELECT COUNT(*) FROM %s WHERE username = "%s"',

$ezin_sys['db']['tables']['users'], $data['username']);

$ezin_sys['db']['tables']['users'], ezin_db_escape($data['username']));

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [1]');

if (($row = @mysql_fetch_array($result, MYSQL_NUM)) == false)

Line 637 function ezin_save_author($data) /* {{{

Line 629 function ezin_save_author($data) /* {{{

$exists = intval($row[0]);

if ($exists) { /* {{{ */

// users update

return ezin_update_author($data);

$query = sprintf('UPDATE %s SET password="%s" WHERE username="%s"',

$ezin_sys['db']['tables']['users'], $data['password'], $data['username']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [21]');

// author_id

$query = sprintf('SELECT COUNT(*) FROM %s WHERE username = "%s"',

$ezin_sys['db']['tables']['users'], $data['username']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [22]');

if (($row = @mysql_fetch_array($result, MYSQL_NUM)) == false)

$row = array();

@mysql_free_result($result);

$author_id = intval($row[0]);

// users update

$query = sprintf('UPDATE %s SET name="%s",email="%s",homepage="%s",description="%s" WHERE id=%d',

$ezin_sys['db']['tables']['authors'], $data['name'], $data['email'], $data['homepage'],

$data['description'], $author_id);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [23]');

} /* }}} */

else if ($ezin_cfg['user_create_role_id'] > 0) { /* {{{ */

// authors INSERT

return ezin_insert_author($data);

$query = sprintf('INSERT INTO %s'

.' (name,email,homepage,description)'

.' VALUES ("%s","%s","%s","%s")',

$ezin_sys['db']['tables']['authors'],

$data['name'], $data['email'], $data['homepage'], $data['description']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [31]');

// author_id

$query = 'SELECT LAST_INSERT_ID()';

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [32]');

if (($row = @mysql_fetch_array($result, MYSQL_NUM)) == false)

$row = array();

@mysql_free_result($result);

$author_id = intval($row[0]);

// users INSERT

$query = sprintf('INSERT INTO %s'

.' (username,password,author_id,role_id)'

.' VALUES ("%s","%s",%d,%d)',

$ezin_sys['db']['tables']['users'],

$data['username'], md5($data['password']),

$author_id, $ezin_cfg['user_create_role_id']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_author() [33]');

} /* }}} */

return $result;

return false;

} /* }}} */

function ezin_update_author($data) /* {{{ */

{

global $ezin_sys, $ezin_cfg;

global $ezin_db_handle;

$data = ezin_db_escape($data);

// users update

$query = sprintf('UPDATE %s SET password="%s" WHERE username="%s"',

$ezin_sys['db']['tables']['users'], $data['password'], $data['username']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_update_author() [1]');

// author_id

$query = sprintf('SELECT COUNT(*) FROM %s WHERE username = "%s"',

$ezin_sys['db']['tables']['users'], $data['username']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_update_author() [2]');

if (($row = @mysql_fetch_array($result, MYSQL_NUM)) == false)

$row = array();

@mysql_free_result($result);

$author_id = intval($row[0]);

// users update

$query = sprintf('UPDATE %s SET name="%s",email="%s",homepage="%s",description="%s" WHERE id=%d',

$ezin_sys['db']['tables']['authors'], $data['name'], $data['email'], $data['homepage'],

$data['description'], $author_id);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_update_author() [3]');

return true;

} /* }}} */

function ezin_insert_author($data) /* {{{ */

{

global $ezin_sys, $ezin_cfg;

global $ezin_db_handle;

$data = ezin_db_escape($data);

// authors INSERT

$query = sprintf('INSERT INTO %s'

.' (name,email,homepage,description)'

.' VALUES ("%s","%s","%s","%s")',

$ezin_sys['db']['tables']['authors'],

$data['name'], $data['email'], $data['homepage'], $data['description']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_insert_author() [1]');

// author_id

$query = 'SELECT LAST_INSERT_ID()';

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_insert_author() [2]');

if (($row = @mysql_fetch_array($result, MYSQL_NUM)) == false)

$row = array();

@mysql_free_result($result);

$author_id = intval($row[0]);

// users INSERT

$query = sprintf('INSERT INTO %s'

.' (username,password,author_id,role_id)'

.' VALUES ("%s","%s",%d,%d)',

$ezin_sys['db']['tables']['users'],

$data['username'], md5($data['password']),

$author_id, $ezin_cfg['user_create_role_id']);

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_insert_author() [3]');

return true;

} /* }}} */

Line 881 function ezin_update_counts_temp() /* {{

Line 895 function ezin_update_counts_temp() /* {{

$delim = '';

$ips = '';

while ($row = mysql_fetch_array($result, MYSQL_NUM)) {

$ips .= $delim.'"'.addslashes($row[0]).'"';

$ips .= $delim.'"'.ezin_db_escape($row[0]).'"';

if ($delim == '')

$delim = ',';

}

Line 907 function ezin_update_counts($author_id,

Line 921 function ezin_update_counts($author_id,

$author_id = intval($author_id);

$section_id = intval($section_id);

$article_id = intval($article_id);

$remote_addr = addslashes($_SERVER['REMOTE_ADDR']);

$remote_addr = ezin_db_escape($_SERVER['REMOTE_ADDR']);

$type_ids = array();

$all_type_ids = array();

if ($author_id > 0) {

Line 1134 function ezin_save_message($data) /* {{{

Line 1148 function ezin_save_message($data) /* {{{

}

$data['ip'] = join(' / ', $data['ip']);

$data = ezin_db_escape($data);

$escape_function = function_exists('mysql_escape_string')

? 'mysql_escape_string'

: 'addslashes';

foreach (array_keys($data) as $key) {

$data[$key] = $escape_function($data[$key]);

}

$query = sprintf('INSERT INTO %s'

.' (id,parent,article_id,author,email,homepage,subject,message,datetime,ip)'

Line 1172 function ezin_check_message_flood() /* {

Line 1180 function ezin_check_message_flood() /* {

$query = 'SELECT count(*) '

.' FROM ' . $ezin_sys['db']['tables']['messages']

.' WHERE ip LIKE "'.addslashes($_SERVER['REMOTE_ADDR']).'%"'

.' WHERE ip LIKE "'.ezin_db_escape($_SERVER['REMOTE_ADDR']).'%"'

.' AND UNIX_TIMESTAMP(SYSDATE()) - UNIX_TIMESTAMP(datetime)'

.' <= '.$timeout;

Line 1220 function ezin_get_poll($section_id, $lan

Line 1228 function ezin_get_poll($section_id, $lan

$query = sprintf('SELECT id FROM %s WHERE type = "global"', $ezin_sys['db']['tables']['sections']);

if (strlen($lang) > 0) {

$query .= sprintf(' AND lang = "%s"', addslashes($lang));

$query .= sprintf(' AND lang = "%s"', ezin_db_escape($lang));

}

$result = @mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_get_poll() [2]');

Line 1357 function ezin_save_feedback($section_id,

Line 1365 function ezin_save_feedback($section_id,

$ip = stripslashes(join(' / ', $ip));

$ua = stripslashes(@$_SERVER['HTTP_USER_AGENT']);

$escape_function = function_exists('mysql_escape_string')

? 'mysql_escape_string'

: 'addslashes';

$query = sprintf('INSERT INTO %s (id,datetime,section_id,ip,user_agent)'

.' VALUES (0,SYSDATE(),%d,"%s","%s")',

$ezin_sys['db']['tables']['feedbacks'], intval($section_id),

$escape_function($ip), $escape_function($ua));

ezin_db_escape($ip), ezin_db_escape($ua));

@mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_feedback() [1]');

Line 1384 function ezin_save_feedback($section_id,

Line 1388 function ezin_save_feedback($section_id,

$query = sprintf('INSERT INTO %s (feedback_id, field, data)'

.' VALUES (%d, "%s", "%s")',

$ezin_sys['db']['tables']['feedback_data'], $feed_id,

$escape_function($key), $escape_function($val));

ezin_db_escape($key), ezin_db_escape($val));

@mysql_query($query, $ezin_db_handle)

or ezin_db_error('ezin_save_feedback() [3]'."[$key]");

}

Line 1404 function ezin_save_email($section_id, $e

Line 1408 function ezin_save_email($section_id, $e

$ip = stripslashes(join(' / ', $ip));

$ua = stripslashes(@$_SERVER['HTTP_USER_AGENT']);

$escape_function = function_exists('mysql_escape_string')

? 'mysql_escape_string'

: 'addslashes';

$query = sprintf('INSERT INTO %s (email,id,dt_added,section_id,ip,user_agent)'

.' VALUES ("%s",0,SYSDATE(),%d,"%s","%s")',

$ezin_sys['db']['tables']['nl_emails'], $escape_function($email),

$ezin_sys['db']['tables']['nl_emails'], ezin_db_escape($email),

intval($section_id), $escape_function($ip), $escape_function($ua));

intval($section_id), ezin_db_escape($ip), ezin_db_escape($ua));

if (@mysql_query($query, $ezin_db_handle)) {

return true;

}

Line 1480 function ezin_cache_save($cache_id = 0,

{

global $ezin_sys;

global $ezin_db_handle;

$cache_id = addslashes(trim($cache_id));

$cache_id = ezin_db_escape(trim($cache_id));

$content = addslashes($content);

$content = ezin_db_escape($content);

$var_var = intval($var_var);

$query = sprintf('INSERT INTO %s (id, var_var, timestamp, content)'

.' VALUES ("%s", %d, UNIX_TIMESTAMP(SYSDATE()), \'%s\')',

Line 1495 function ezin_cache_load($cache_id = 'X'

{

global $ezin_sys;

global $ezin_db_handle;

$cache_id = addslashes(trim($cache_id));

$cache_id = ezin_db_escape(trim($cache_id));

$var_var = 0;

$query = sprintf('SELECT * FROM %s WHERE id = "%s"',

$ezin_sys['db']['tables']['cache'], $cache_id);

Line 1534 function ezin_cache_clear($cache_id = 'X

$delete_gs = true;

continue;

}

$cache_id_list[] = "id LIKE '".addslashes(trim($id))."%'";

$cache_id_list[] = "id LIKE '".ezin_db_escape(trim($id))."%'";

}

$query = sprintf('DELETE FROM %s WHERE %s',

$ezin_sys['db']['tables']['cache'],

Line 1546 function ezin_cache_clear($cache_id = 'X

} else if ($cache_id == 'Sglobal') {

$delete_gs = true;

} else {

$cache_id = addslashes(trim($cache_id));

$cache_id = ezin_db_escape(trim($cache_id));

$query = sprintf('DELETE FROM %s WHERE id LIKE "%s%%"',

$ezin_sys['db']['tables']['cache'], $cache_id);

}

Platon Group <platon@platon.org> http://platon.org/


Copyright © 2002-2006 Platon Group Site powered by Metafox CMS	Go to Top