keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

use raw db queries wherever query items could contain '%'

Browse source
This commit is contained in:
Friendika 2010-11-09 15:11:47 -08:00
parent c50f491c3d
commit f7c0480f1b
4 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
include/dba.php
View file

@ -134,6 +134,16 @@ function q($sql) {
return $ret;
}}
// raw db query, no arguments
if(! function_exists('dbq')) {
function dbq($sql) {
global $db;
$ret = $db->q($sql);
return $ret;
}}
// Caller is responsible for ensuring that any integer arguments to
// dbesc_array are actually integers and not malformed strings containing

2
include/items.php
View file

@ -550,7 +550,7 @@ function item_store($arr) {
logger('item_store: ' . print_r($arr,true), LOGGER_DATA);
$r = q("INSERT INTO `item` (`"
$r = dbq("INSERT INTO `item` (`"
. implode("`, `", array_keys($arr))
. "`) VALUES ('"
. implode("', '", array_values($arr))

2
mod/dfrn_notify.php
View file

@ -106,7 +106,7 @@ function dfrn_notify_post(&$a) {
dbesc_array($msg);
$r = q("INSERT INTO `mail` (`" . implode("`, `", array_keys($msg))
$r = dbq("INSERT INTO `mail` (`" . implode("`, `", array_keys($msg))
. "`) VALUES ('" . implode("', '", array_values($msg)) . "')" );
// send email notification if requested.

2
mod/profiles.php
View file

@ -249,7 +249,7 @@ function profiles_content(&$a) {
dbesc_array($r1[0]);
$r2 = q("INSERT INTO `profile` (`"
$r2 = dbq("INSERT INTO `profile` (`"
. implode("`, `", array_keys($r1[0]))
. "`) VALUES ('"
. implode("', '", array_values($r1[0]))