Peter M. Groen / knowledgetree

Commit 88d2fbe4554849757a21a33338a752ae63a2201d

Authored by nbm
1 parent 2f065d4a

Parameterise (or vette/mark) more SQL queries 


git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@3062 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 22 changed files with 168 additions and 140 deletions
lib/archiving/ArchiveRestorationRequest.inc
  View file @88d2fbe
... ... @@ -199,7 +199,7 @@ class ArchiveRestorationRequest extends KTEntity {
199 199 global $default;
200 200 $aArchiveRestorationRequestArray = array();
201 201 $sql = $default->db;
202   - $result = $sql->query("SELECT * FROM $default->archive_restoration_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  202 + $result = $sql->query("SELECT * FROM $default->archive_restoration_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
203 203 if ($result) {
204 204 while ($sql->next_record()) {
205 205 $aArchiveRestorationRequestArray[] = & ArchiveRestorationRequest::get($sql->f("id"));
... ...
lib/archiving/ArchivingSettings.inc
  View file @88d2fbe
... ... @@ -191,7 +191,7 @@ class ArchivingSettings extends KTEntity {
191 191 global $default;
192 192 $aArchivingSettings = array();
193 193 $sql = $default->db;
194   - $result = $sql->query("SELECT * FROM $default->archiving_settings_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  194 + $result = $sql->query("SELECT * FROM $default->archiving_settings_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
195 195 if ($result) {
196 196 while ($sql->next_record()) {
197 197 $oArchivingSettings = & ArchivingSettings::get($sql->f("id"));
... ...
lib/archiving/ArchivingType.inc
  View file @88d2fbe
... ... @@ -113,7 +113,7 @@ class ArchivingType extends KTEntity {
113 113 global $default;
114 114 $aArchivingTypeArray = array();
115 115 $sql = $default->db;
116   - $result = $sql->query("SELECT * FROM $default->archiving_type_lookup_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  116 + $result = $sql->query("SELECT * FROM $default->archiving_type_lookup_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
117 117 if ($result) {
118 118 $iCount = 0;
119 119 while ($sql->next_record()) {
... ...
lib/archiving/DocumentArchiving.inc
  View file @88d2fbe
... ... @@ -156,7 +156,7 @@ class DocumentArchiving extends KTEntity {
156 156 global $default;
157 157 $aDocumentArchivingArray = array();
158 158 $sql = $default->db;
159   - $result = $sql->query("SELECT * FROM $default->document_archiving_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  159 + $result = $sql->query("SELECT * FROM $default->document_archiving_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
160 160 if ($result) {
161 161 $iCount = 0;
162 162 while ($sql->next_record()) {
... ...
lib/archiving/TimePeriod.inc
  View file @88d2fbe
... ... @@ -135,7 +135,7 @@ class TimePeriod extends KTEntity {
135 135 global $default;
136 136 $aTimePeriodArray = array();
137 137 $sql = $default->db;
138   - $result = $sql->query("SELECT * FROM $default->time_period_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  138 + $result = $sql->query("SELECT * FROM $default->time_period_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
139 139 if ($result) {
140 140 $iCount = 0;
141 141 while ($sql->next_record()) {
... ...
lib/archiving/TimeUnit.inc
  View file @88d2fbe
... ... @@ -112,7 +112,7 @@ class TimeUnit extends KTEntity {
112 112 global $default;
113 113 $aTimeUnitArray = array();
114 114 $sql = $default->db;
115   - $result = $sql->query("SELECT * FROM $default->time_unit_lookup_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  115 + $result = $sql->query("SELECT * FROM $default->time_unit_lookup_table " . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
116 116 if ($result) {
117 117 $iCount = 0;
118 118 while ($sql->next_record()) {
... ...
lib/authentication/DBAuthenticator.inc
  View file @88d2fbe
... ... @@ -62,14 +62,15 @@ class DBAuthenticator extends Authenticator {
62 62 global $default;
63 63  
64 64 $sql = $default->db;
65   - $sQuery = "SELECT ";
  65 + $sQuery = "SELECT ";/*ok*/
66 66 // build select
67 67 for ($i=0; $i<count($aAttributes); $i++) {
68 68 $sQuery .= $aAttributes[$i] . (( ($i+1) == count($aAttributes) ) ? "" : ", ");
69 69 }
70   - $sQuery .= " FROM $default->users_table WHERE username = '$sUserName'";
  70 + $sQuery .= " FROM $default->users_table WHERE username = ?";
  71 + $aParams = array($sUserName);
71 72  
72   - if ($sql->query($sQuery)) {
  73 + if ($sql->query(array($sQuery, $aParams))) {
73 74 $aUserResults = array();
74 75 while ($sql->next_record()) {
75 76 for ($i=0; $i<count($aAttributes); $i++) {
... ... @@ -93,12 +94,12 @@ class DBAuthenticator extends Authenticator {
93 94 global $default;
94 95  
95 96 $sql = $default->db;
96   - $sQuery = "SELECT ";
  97 + $sQuery = "SELECT ";/*ok*/
97 98 // build select
98 99 for ($i=0; $i<count($aAttributes); $i++) {
99 100 $sQuery .= $aAttributes[$i] . (( ($i+1) == count($aAttributes) ) ? "" : ", ");
100 101 }
101   - $sQuery .= " FROM $default->users_table where username like '%$sUserNameSearch%'";
  102 + $sQuery .= " FROM $default->users_table where username like '%" . DBUtil::escapeSimple($sUserNameSearch) . "%'";
102 103  
103 104 if ($sql->query($sQuery)) {
104 105 $aUserResults = array();
... ...
lib/browse/DocumentTypeBrowser.inc
  View file @88d2fbe
... ... @@ -79,7 +79,7 @@ class DocumentTypeBrowser extends Browser {
79 79 $results["documentTypes"][] = array("id" => $iDocumentTypeID, "name" => $documentTypeName);
80 80  
81 81 // create query to retrieve documents with this document type
82   - $documentQuery = "SELECT d.id as id FROM $default->documents_table d ";
  82 + $documentQuery = "SELECT d.id as id FROM $default->documents_table d ";/*wc*/
83 83 if ( isset($aLookupCriteria) ) {
84 84 //$documentQuery .= "INNER JOIN " . $aLookupCriteria["table"] . " lt ON d.$this->sSortField=lt.id ";
85 85 $documentQuery .= "INNER JOIN " . $aLookupCriteria["table"] . " lt ON ";
... ...
lib/browse/FolderBrowser.inc
  View file @88d2fbe
... ... @@ -119,7 +119,7 @@ class FolderBrowser extends Browser {
119 119 // if we're sorting by name or creator_id then sort folders in the appropriate direction
120 120  
121 121 $aParams = array();
122   - $sFolderQuery = "SELECT f.id FROM $default->folders_table AS f ";
  122 + $sFolderQuery = "SELECT f.id FROM $default->folders_table AS f ";/*ok*/
123 123 if (in_array($this->sSortField, array("name", "creator_id"))) {
124 124 if (isset($aLookupCriteria)) {
125 125 $sFolderQuery .= "INNER JOIN " . $aLookupCriteria["table"] . " lt ON f.$this->sSortField=lt.id WHERE parent_id = ?";
... ... @@ -154,7 +154,7 @@ class FolderBrowser extends Browser {
154 154 $default->log->debug("Going on to document checking");
155 155  
156 156 // create query to retrieve documents in this folder
157   - $documentQuery = "SELECT d.id as id FROM $default->documents_table AS d ";
  157 + $documentQuery = "SELECT d.id as id FROM $default->documents_table AS d ";/*wc*/
158 158 if (isset($aLookupCriteria)) {
159 159 $documentQuery .= "INNER JOIN " . $aLookupCriteria["table"] . " lt ON ";
160 160 $documentQuery .= "d.$this->sSortField" . "=lt." . (isset($aLookupCriteria["joinColumn"]) ? $aLookupCriteria["joinColumn"] : "id");
... ...
lib/dashboard/Dashboard.inc
  View file @88d2fbe
... ... @@ -49,12 +49,13 @@ class Dashboard {
49 49 */
50 50 function getPendingWebDocuments(){
51 51 global $default;
52   - $sQuery = "SELECT wd.id FROM web_documents wd " .
  52 + $sQuery = "SELECT wd.id FROM web_documents wd " . /*ok*/
53 53 "INNER JOIN web_sites ws ON wd.web_site_id = ws.id " .
54   - "WHERE ws.web_master_id=" . $this->iUserID . " AND wd.status_id=1";
  54 + "WHERE ws.web_master_id = ? AND wd.status_id = 1";
  55 + $aParams = array($this->iUserID);
55 56 $aDocumentList = array();
56 57 $sql = $default->db;
57   - if ($sql->query($sQuery)) {
  58 + if ($sql->query(array($sQuery, $aParams))) {
58 59 while ($sql->next_record()) {
59 60 $aDocumentList[] = & WebDocument::get($sql->f("id"));
60 61 }
... ... @@ -77,7 +78,7 @@ class Dashboard {
77 78 function getPendingCollaborationDocuments(){
78 79 global $default;
79 80  
80   - $sQuery = "SELECT document_id FROM $default->folders_user_roles_table WHERE active=1 AND user_id=" . $this->iUserID;
  81 + $sQuery = array("SELECT document_id FROM $default->folders_user_roles_table WHERE active=1 AND user_id = ?", $this->iUserID);/*ok*/
81 82 $aDocumentList = array();
82 83 $sql = $default->db;
83 84 if ($sql->query($sQuery)) {
... ... @@ -120,7 +121,7 @@ class Dashboard {
120 121 */
121 122 function getDependantDocuments() {
122 123 global $default;
123   - $sQuery = "SELECT id FROM $default->dependant_document_instance_table WHERE user_id = " . $this->iUserID;
  124 + $sQuery = array("SELECT id FROM $default->dependant_document_instance_table WHERE user_id = ?", $this->iUserID);/*ok*/
124 125 $aDocumentList = array();
125 126 $sql = $default->db;
126 127 $sql->query($sQuery);
... ... @@ -129,4 +130,4 @@ class Dashboard {
129 130 }
130 131 return $aDocumentList;
131 132 }
132   -}
133 133 \ No newline at end of file
  134 +}
... ...
lib/dashboard/DashboardNews.inc
  View file @88d2fbe
... ... @@ -322,7 +322,7 @@ class DashboardNews extends KTEntity {
322 322 function & get($iNewsID) {
323 323 global $default;
324 324 $sql = $default->db;
325   - $sql->query("SELECT * FROM $default->news_table WHERE id = $iNewsID");
  325 + $sql->query(array("SELECT * FROM $default->news_table WHERE id = ?", $iNewsID));/*ok*/
326 326 if ($sql->next_record()) {
327 327 $aImage = array( "image" => $sql->f("image"),
328 328 "filesize" => $sql->f("image_size"),
... ... @@ -346,7 +346,7 @@ class DashboardNews extends KTEntity {
346 346 global $default;
347 347 $aDashboardNewsArray = array();
348 348 $sql = $default->db;
349   - $result = $sql->query("SELECT * FROM " . $default->news_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : "") . " ORDER BY rank ASC");
  349 + $result = $sql->query("SELECT * FROM " . $default->news_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : "") . " ORDER BY rank ASC");/*wc*/
350 350 if ($result) {
351 351 $iCount = 0;
352 352 while ($sql->next_record()) {
... ...
lib/discussions/DiscussionComment.inc
  View file @88d2fbe
... ... @@ -155,7 +155,7 @@ class DiscussionComment extends KTEntity {
155 155 function & get($iNewCommentID) {
156 156 global $default;
157 157 $sql = $default->db;
158   - $result = $sql->query("SELECT * FROM $default->discussion_comments_table WHERE id = $iNewCommentID");
  158 + $result = $sql->query(array("SELECT * FROM $default->discussion_comments_table WHERE id = ?", $iNewCommentID));/*ok*/
159 159 if ($result) {
160 160 if ($sql->next_record()) {
161 161 $oDiscussionComment = & new DiscussionComment($sql->f("body"),$sql->f("subject"),$sql->f("user_id"),$sql->f("thread_id"),$sql->f("in_reply_to"));
... ... @@ -180,7 +180,7 @@ class DiscussionComment extends KTEntity {
180 180 global $default;
181 181 $aDiscussionComments = array();
182 182 $sql = $default->db;
183   - $result = $sql->query("SELECT * FROM " . $default->discussion_comments_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  183 + $result = $sql->query("SELECT * FROM " . $default->discussion_comments_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
184 184 if ($result) {
185 185 while ($sql->next_record()) {
186 186 $aDiscussionComments[] = & DiscussionComment::get($sql->f("id"));
... ... @@ -212,7 +212,7 @@ class DiscussionComment extends KTEntity {
212 212 if ($this->iId > 0) {
213 213 //check to see if group is linked to a unit
214 214 $sql = $default->db;
215   - $query = "SELECT * FROM ". $default->discussion_comments_table . " WHERE id = " . $this->iId ;
  215 + $query = array("SELECT * FROM ". $default->discussion_comments_table . " WHERE id = ?", $this->iId);/*ok*/
216 216 $sql->query($query);
217 217 $rows = $sql->num_rows($sql);
218 218  
... ...
lib/discussions/DiscussionThread.inc
  View file @88d2fbe
... ... @@ -142,12 +142,16 @@ class DiscussionThread extends KTEntity{
142 142 global $default;
143 143  
144 144 $sql = $default->db;
145   - $result = $sql->query("SELECT id FROM $default->discussion_threads_table WHERE document_id = $this->iDocumentID ORDER BY id");
  145 + $aQuery = array("SELECT id FROM $default->discussion_threads_table WHERE document_id = ? ORDER BY id",/*ok*/
  146 + $this->iDocumentID);
  147 + $result = $sql->query($aQuery);
146 148 if ($result) {
147 149 $sql->next_record();
148 150 $iThreadID = $sql->f("id");
149 151  
150   - $result = $sql->query("SELECT id FROM $default->discussion_comments_table WHERE thread_id = $iThreadID ORDER BY date Desc");
  152 + $aQuery = array("SELECT id FROM $default->discussion_comments_table WHERE thread_id = ? ORDER BY date DESC",/*ok*/
  153 + $iThreadID);
  154 + $result = $sql->query($aQuery);
151 155  
152 156 if ($result) {
153 157 while ($sql->next_record()) {
... ... @@ -178,7 +182,7 @@ class DiscussionThread extends KTEntity{
178 182 global $default;
179 183 $aDiscussionThreads = array();
180 184 $sql = $default->db;
181   - $result = $sql->query("SELECT * FROM " . $default->discussion_threads_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  185 + $result = $sql->query("SELECT * FROM " . $default->discussion_threads_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
182 186 if ($result) {
183 187 while ($sql->next_record()) {
184 188 $aDiscussionThreads[] = & DiscussionThread::get($sql->f("id"));
... ... @@ -191,7 +195,7 @@ class DiscussionThread extends KTEntity{
191 195 function getThreadIDforDoc($iDocumentID){
192 196 global $default;
193 197 $sql = $default->db;
194   - $result = $sql->query("SELECT id FROM $default->discussion_threads_table WHERE document_id = $iDocumentID");
  198 + $result = $sql->query(array("SELECT id FROM $default->discussion_threads_table WHERE document_id = ?", $iDocumentID));/*ok*/
195 199 if ($result) {
196 200 if ($sql->next_record()) {
197 201 if ($sql->f("id") > 0) {
... ... @@ -217,7 +221,7 @@ class DiscussionThread extends KTEntity{
217 221 function & get($iNewThreadID) {
218 222 global $default;
219 223 $sql = $default->db;
220   - $result = $sql->query("SELECT * FROM $default->discussion_threads_table WHERE id = $iNewThreadID");
  224 + $result = $sql->query(array("SELECT * FROM $default->discussion_threads_table WHERE id = ?", $iNewThreadID));/*ok*/
221 225 if ($result) {
222 226 if ($sql->next_record()) {
223 227  
... ... @@ -262,7 +266,7 @@ class DiscussionThread extends KTEntity{
262 266 if ($this->iId > 0) {
263 267 //check to see if group is linked to a unit
264 268 $sql = $default->db;
265   - $query = "SELECT * FROM ". $default->discussion_threads_table ." WHERE id = " . $this->iId ;
  269 + $query = array("SELECT * FROM ". $default->discussion_threads_table ." WHERE id = ?", $this->iId);/*ok*/
266 270 $sql->query($query);
267 271 $rows = $sql->num_rows($sql);
268 272  
... ...
lib/documentmanagement/DependantDocumentInstance.inc
  View file @88d2fbe
... ... @@ -141,7 +141,7 @@ class DependantDocumentInstance extends KTEntity {
141 141 function & get($iDependantDocumentID) {
142 142 global $default;
143 143 $sql = $default->db;
144   - $result = $sql->query("SELECT * FROM $default->dependant_document_instance_table WHERE id = $iDependantDocumentID");
  144 + $result = $sql->query(array("SELECT * FROM $default->dependant_document_instance_table WHERE id = ?", $iDependantDocumentID));/*ok*/
145 145 if ($result) {
146 146 if ($sql->next_record()) {
147 147 $oDependantDocument = & new DependantDocumentInstance($sql->f("document_title"), $sql->f("user_id"), $sql->f("template_document_id"), $sql->f("parent_document_id"));
... ...
lib/documentmanagement/DependantDocumentTemplate.inc
  View file @88d2fbe
... ... @@ -149,7 +149,7 @@ class DependantDocumentTemplate extends KTEntity {
149 149 function & get($iDependantDocumentID) {
150 150 global $default;
151 151 $sql = $default->db;
152   - $result = $sql->query("SELECT * FROM $default->dependant_document_template_table WHERE id = $iDependantDocumentID");
  152 + $result = $sql->query(array("SELECT * FROM $default->dependant_document_template_table WHERE id = ?", $iDependantDocumentID));/*ok*/
153 153 if ($result) {
154 154 if ($sql->next_record()) {
155 155 $DependantDocumentTemplate = & new DependantDocumentTemplate($sql->f("document_title"), $sql->f("default_user_id"), $sql->f("group_folder_approval_link_id"), $sql->f("template_document_id"));
... ... @@ -177,7 +177,7 @@ class DependantDocumentTemplate extends KTEntity {
177 177 $aDependantDocumentTemplateArray = array();
178 178 $sql = $default->db;
179 179 // TODO: join on sys_deleted
180   - $result = $sql->query("SELECT * FROM " . $default->dependant_document_template_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
  180 + $result = $sql->query("SELECT * FROM " . $default->dependant_document_template_table . (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));/*wc*/
181 181 if ($result) {
182 182 $iCount = 0;
183 183 while ($sql->next_record()) {
... ...
lib/documentmanagement/Document.inc
  View file @88d2fbe
... ... @@ -286,7 +286,7 @@ class Document extends KTEntity {
286 286 //if the folder is not the root folder
287 287 if ($iFolderID != 0) {
288 288 $sql = $default->db;
289   - $sql->query("SELECT parent_id FROM $default->folders_table WHERE ID = " . quote($iFolderID));
  289 + $sql->query(array("SELECT parent_id FROM $default->folders_table WHERE ID = ?", $iFolderID));/*ok*/
290 290 $sql->next_record();
291 291 return $this->generateParentFolderIDS($sql->f("parent_id")) . ",$iFolderID";
292 292 }
... ... @@ -314,7 +314,7 @@ class Document extends KTEntity {
314 314 //if the folder is not the root folder
315 315 if ($iFolderID != 0) {
316 316 $sql = $default->db;
317   - $sql->query("SELECT name, parent_id FROM $default->folders_table WHERE ID = " . quote($iFolderID));
  317 + $sql->query(array("SELECT name, parent_id FROM $default->folders_table WHERE ID = ?", $iFolderID));/*ok*/
318 318 $sql->next_record();
319 319 return $this->generateFullFolderPath($sql->f("parent_id")) . "/" . $sql->f("name");
320 320 }
... ... @@ -382,12 +382,12 @@ class Document extends KTEntity {
382 382 $sql = $default->db;
383 383  
384 384 // group permissions
385   - $sGroupPerms = "INSERT INTO $default->search_permissions_table (user_id, document_id) " .
386   - "SELECT UGL.user_id AS user_id, D.id AS document_id " .
  385 + $sGroupPerms = array("INSERT INTO $default->search_permissions_table (user_id, document_id) " .
  386 + "SELECT UGL.user_id AS user_id, D.id AS document_id " ./*ok*/
387 387 "FROM $default->documents_table AS D INNER JOIN folders AS F ON D.folder_id = F.id " .
388 388 "INNER JOIN $default->groups_folders_table AS GFL ON GFL.folder_id = F.id " .
389 389 "INNER JOIN $default->users_groups_table AS UGL ON UGL.group_id = GFL.group_id " .
390   - "WHERE D.id=" . quote($this->iId);
  390 + "WHERE D.id = ?", $this->iId);
391 391 $default->log->debug("addDocument groupPerms=$sGroupPerms");
392 392 if ($sql->query($sGroupPerms)) {
393 393 $default->log->debug("groupPerms succeeded");
... ... @@ -395,10 +395,10 @@ class Document extends KTEntity {
395 395 $default->log->error("groupPerms failed");
396 396 }
397 397 // role permissions
398   - $sRolePerms = "INSERT INTO $default->search_permissions_table (user_id, document_id) " .
399   - "SELECT user_id, document_id " .
  398 + $sRolePerms = array("INSERT INTO $default->search_permissions_table (user_id, document_id) " .
  399 + "SELECT user_id, document_id " ./*ok*/
400 400 "FROM $default->folders_user_roles_table " .
401   - "WHERE document_id=" . quote($this->iId);
  401 + "WHERE document_id = ?", $this->iId);
402 402 $default->log->info("addDocument rolePerms=$sRolePerms");
403 403 if ($sql->query($sRolePerms)) {
404 404 $default->log->debug("rolePerms succeeded");
... ... @@ -407,11 +407,11 @@ class Document extends KTEntity {
407 407 }
408 408  
409 409 // public folders
410   - $sPublicFolderPerms = "INSERT INTO $default->search_permissions_table (user_id, document_id) " .
411   - "SELECT U.id, D.id " .
  410 + $sPublicFolderPerms = array("INSERT INTO $default->search_permissions_table (user_id, document_id) " .
  411 + "SELECT U.id, D.id " . /*ok*/
412 412 "FROM $default->users_table AS U, $default->documents_table AS D INNER JOIN $default->folders_table AS F ON D.folder_id = F.id " .
413 413 "WHERE F.is_public = 1 " .
414   - "AND D.id=" . quote($this->iId);
  414 + "AND D.id = ?", $this->iId);
415 415 $default->log->debug("addDocument publicFolder=$sPublicFolderPerms");
416 416 if ($sql->query($sPublicFolderPerms)) {
417 417 $default->log->debug("publicFolder succeeded");
... ... @@ -420,10 +420,10 @@ class Document extends KTEntity {
420 420 }
421 421  
422 422 // creator permissions
423   - $sCreatorPerms = "INSERT INTO $default->search_permissions_table (user_id, document_id) " .
424   - "SELECT creator_id, id " .
  423 + $sCreatorPerms = array("INSERT INTO $default->search_permissions_table (user_id, document_id) " .
  424 + "SELECT creator_id, id " ./*ok*/
425 425 "FROM $default->documents_table " .
426   - "WHERE id=" . quote($this->iId);
  426 + "WHERE id = ?", $this->iId);
427 427 $default->log->debug("addDocument creatorPerms=$sCreatorPerms");
428 428 if ($sql->query($sCreatorPerms)) {
429 429 $default->log->debug("creatorPerms succeeded");
... ... @@ -439,11 +439,11 @@ class Document extends KTEntity {
439 439 function beginCollaborationProcess() {
440 440 global $default;
441 441 //get the steps in this document's collaboration process
442   - $sQuery = "SELECT FURL.id, GFAL.precedence " .
  442 + $sQuery = array("SELECT FURL.id, GFAL.precedence " ./*ok*/
443 443 "FROM $default->folders_user_roles_table AS FURL " .
444 444 "INNER JOIN $default->groups_folders_approval_table AS GFAL ON FURL.group_folder_approval_id = GFAL.id " .
445   - "WHERE document_id = " . quote($this->iId) . " " .
446   - "ORDER BY GFAL.precedence ASC";
  445 + "WHERE document_id = ? " .
  446 + "ORDER BY GFAL.precedence ASC", $this->iId);
447 447 $sql = $default->db;
448 448 $sql->query($sQuery);
449 449 if ($sql->next_record()) {
... ... @@ -498,12 +498,12 @@ class Document extends KTEntity {
498 498 //get the current step
499 499 //if the user is assinged to two or more roles, make sure we get the current
500 500 //one by ordering by precedence
501   - $sql->query("SELECT FURL.id AS id, GFAT.precedence " .
  501 + $sql->query(array("SELECT FURL.id AS id, GFAT.precedence " ./*ok*/
502 502 "FROM $default->groups_folders_approval_table AS GFAT " .
503 503 "INNER JOIN $default->folders_user_roles_table AS FURL ON GFAT.id = FURL.group_folder_approval_id " .
504   - "WHERE document_id = $this->iId AND FURL.user_id = " . quote($_SESSION["userID"]) . " " .
  504 + "WHERE document_id = ? AND FURL.user_id = ? " .
505 505 "AND done = 0 " .
506   - "ORDER BY precedence ASC");
  506 + "ORDER BY precedence ASC", array($this->iId, $_SESSION["userID"])));
507 507 if ($sql->next_record()) {
508 508 //set it as done
509 509 $oFolderUserRole = FolderUserRole::get($sql->f("id"));
... ... @@ -527,7 +527,7 @@ class Document extends KTEntity {
527 527 global $default, $lang_err_doc_not_exist;
528 528 if (strlen($iDocumentID) > 0) {
529 529 $sql = $default->db;
530   - $sql->query("SELECT * FROM $default->documents_table WHERE id = " . quote($iDocumentID));
  530 + $sql->query(array("SELECT * FROM $default->documents_table WHERE id = ?", $iDocumentID));/*ok*/
531 531 if ($sql->next_record()) {
532 532 $oDocument = & new Document($sql->f("name"), $sql->f("filename"), $sql->f("size"), $sql->f("creator_id"), $sql->f("mime_id"), $sql->f("folder_id"), $sql->f("description"));
533 533 $oDocument->setDocumentTypeID($sql->f("document_type_id"));
... ... @@ -562,7 +562,7 @@ class Document extends KTEntity {
562 562 $aDocumentArray;
563 563 settype($aDocumentArray, "array");
564 564 $sql = $default->db;
565   - $result = $sql->query("SELECT * FROM " . $default->documents_table .
  565 + $result = $sql->query("SELECT * FROM " . $default->documents_table . /*wc*/
566 566 (isset($sWhereClause) ? " WHERE " . $sWhereClause : ""));
567 567 if ($result) {
568 568 $iCount = 0;
... ... @@ -589,11 +589,11 @@ class Document extends KTEntity {
589 589 $aDocumentFieldArray;
590 590 settype($aDocumentFieldArray,"array");
591 591 $sql = $default->db;
592   - $result = $sql->query("SELECT DF.id AS id, DF.name AS name, DF.data_type AS data_type " .
  592 + $result = $sql->query(array("SELECT DF.id AS id, DF.name AS name, DF.data_type AS data_type " ./*ok*/
593 593 "FROM $default->document_fields_table AS DF " .
594 594 "INNER JOIN $default->document_type_fields_table AS DTFL ON DF.id = DTFL.field_id " .
595   - "WHERE DTFL.document_type_id = " . quote($iDocumentTypeID) . ($bMandatoryOnly ? "AND DFTL.is_mandatory = 1 " : " ") .
596   - "ORDER BY DF.name ASC");
  595 + "WHERE DTFL.document_type_id = ? " . ($bMandatoryOnly ? "AND DFTL.is_mandatory = 1 " : " ") .
  596 + "ORDER BY DF.name ASC", $iDocumentTypeID));
597 597 if ($result) {
598 598 $iCount = 0;
599 599 while ($sql->next_record()) {
... ... @@ -619,9 +619,9 @@ class Document extends KTEntity {
619 619 global $default, $lang_err_database;
620 620 $aDocumentHistory = array();
621 621 $sql = $default->db;
622   - $result = $sql->query("SELECT * FROM " . $default->document_transactions_table . " " .
623   - "WHERE document_id = " . quote($this->iId) . " " .
624   - "ORDER BY datetime DESC");
  622 + $result = $sql->query(array("SELECT * FROM " . $default->document_transactions_table . " " ./*ok*/
  623 + "WHERE document_id = ? " .
  624 + "ORDER BY datetime DESC", $this->iId));
625 625 if ($result) {
626 626 $iCount = 0;
627 627 while($sql->next_record()) {
... ... @@ -695,10 +695,11 @@ class Document extends KTEntity {
695 695 function documentExists($sFileName, $iFolderID) {
696 696 global $default;
697 697 $sql = $default->db;
698   - $sQuery = "SELECT * FROM $default->documents_table " .
699   - "WHERE filename = " . quote($sFileName) .
700   - " AND folder_id = " . quote($iFolderID) .
701   - " AND status_id = " . LIVE;
  698 + $sQuery = "SELECT * FROM $default->documents_table " ./*ok*/
  699 + "WHERE filename = ? " .
  700 + " AND folder_id = ?" .
  701 + " AND status_id = ?";
  702 + $aParams = array($sFileName, $iFolderID, LIVE);
702 703 $sql->query($sQuery);
703 704 if ($sql->next_record()) {
704 705 return true;
... ... @@ -716,8 +717,8 @@ class Document extends KTEntity {
716 717 global $default, $lang_err_database, $lang_err_doc_not_exist;
717 718 $sql = $default->db;
718 719  
719   - if ($sql->query("SELECT name FROM $default->documents_table " .
720   - "WHERE id = " . quote($iDocumentID))) {
  720 + if ($sql->query(array("SELECT name FROM $default->documents_table " ./*ok*/
  721 + "WHERE id = ?", $iDocumentID))) {
721 722 if ($sql->next_record()) {
722 723 return $sql->f("name");
723 724 }
... ... @@ -746,11 +747,11 @@ class Document extends KTEntity {
746 747 function documentIsAssignedDocTypeInFolder($iFolderID, $iFolderDocTypeID) {
747 748 global $default;
748 749 $sql = $default->db;
749   - $sql->query("SELECT * " .
  750 + $sql->query(array("SELECT * " . /*ok*/
750 751 "FROM $default->folder_doctypes_table AS FDL " .
751 752 "INNER JOIN $default->documents_table AS D ON D.document_type_id = FDL.document_type_id " .
752   - "WHERE FDL.id = " . quote($iFolderDocTypeID) . " " .
753   - "AND D.folder_id = " . quote($iFolderID));
  753 + "WHERE FDL.id = ? " .
  754 + "AND D.folder_id = ?", array($iFolderDocTypeID, $iFolderID)));
754 755 if ($sql->next_record()) {
755 756 return true;
756 757 }
... ... @@ -763,10 +764,10 @@ class Document extends KTEntity {
763 764 */
764 765 function removeInvalidDocumentTypeEntries() {
765 766 global $default;
766   - $sQuery = "SELECT field_id FROM $default->document_type_fields_table DTFL " .
  767 + $sQuery = array("SELECT field_id FROM $default->document_type_fields_table DTFL " . /*ok*/
767 768 "INNER JOIN $default->document_fields_table AS DF ON DF.id = DTFL.field_id " .
768   - "WHERE DTFL.document_type_id = " . quote($this->iDocumentTypeID) . " " .
769   - "AND DF.is_generic = 0";
  769 + "WHERE DTFL.document_type_id = ? " .
  770 + "AND DF.is_generic = 0", $this->iDocumentTypeID);
770 771 $sql = $default->db;
771 772 $sql->query($sQuery);
772 773 $aFieldIDs = array();
... ... @@ -798,7 +799,7 @@ class Document extends KTEntity {
798 799 function hasCollaboration() {
799 800 global $default;
800 801 $sql = $default->db;
801   - $sql->query("SELECT id AS count from $default->groups_folders_approval_table WHERE folder_id = $this->iFolderID");
  802 + $sql->query(array("SELECT id AS count from $default->groups_folders_approval_table WHERE folder_id = ?", $this->iFolderID));/*ok*/
802 803 if ($sql->next_record()) {
803 804 return true;
804 805 }
... ...
lib/documentmanagement/DocumentCollaboration.inc
  View file @88d2fbe
... ... @@ -34,7 +34,9 @@ class DocumentCollaboration {
34 34 function documentCollaborationStarted($iDocumentID) {
35 35 global $default;
36 36 $sql = $default->db;
37   - $sql->query("SELECT id FROM $default->folders_user_roles_table WHERE document_id = $iDocumentID AND (active = 1 OR done = 1)");
  37 + $sQuery = "SELECT id FROM $default->folders_user_roles_table WHERE document_id = ? AND (active = 1 OR done = 1)";/*ok*/
  38 + $aParams = array($iDocumentID);
  39 + $sql->query(array($sQuery, $aParams));
38 40 if ($sql->next_record()) {
39 41 return true;
40 42 }
... ... @@ -44,7 +46,9 @@ class DocumentCollaboration {
44 46 function documentCollaborationDone($iDocumentID) {
45 47 global $default;
46 48 $sql = $default->db;
47   - $sql->query("SELECT id FROM $default->folders_user_roles_table WHERE document_id = $iDocumentID AND done = 0");
  49 + $sQuery = "SELECT id FROM $default->folders_user_roles_table WHERE document_id = ? AND done = 0";/*ok*/
  50 + $aParams = array($iDocumentID);
  51 + $sql->query(array($sQuery, $aParams));
48 52 if ($sql->num_rows() > 0) {
49 53 return false;
50 54 } else {
... ... @@ -60,7 +64,9 @@ class DocumentCollaboration {
60 64 function userIsPerformingCurrentCollaborationStep($iDocumentID) {
61 65 global $default;
62 66 $sql = $default->db;
63   - $sql->query("SELECT id FROM $default->folders_user_roles_table WHERE document_id = $iDocumentID AND active = 1 AND user_id = " . $_SESSION["userID"]);
  67 + $sQuery = "SELECT id FROM $default->folders_user_roles_table WHERE document_id = ? AND active = 1 AND user_id = ?";/*ok*/
  68 + $aParams = array($iDocumentID, $_SESSION["userID"]);
  69 + $sql->query(array($sQuery, $aParams));
64 70 if ($sql->next_record()) {
65 71 return true;
66 72 }
... ... @@ -98,7 +104,7 @@ class DocumentCollaboration {
98 104 function isLastStepInCollaborationProcess($iDocumentID) {
99 105 global $default;
100 106 $sql = $default->db;
101   - $sQuery = "SELECT id FROM $default->folders_user_roles_table WHERE document_id = $iDocumentID AND done = 0";
  107 + $sQuery = "SELECT id FROM $default->folders_user_roles_table WHERE document_id = $iDocumentID AND done = 0";/*ok*/
102 108 $sql->query($sQuery);
103 109 $default->log->info("lastCollabStep:$sQuery");
104 110 if ($sql->num_rows() > 1) {
... ... @@ -116,11 +122,12 @@ class DocumentCollaboration {
116 122 global $default;
117 123 $sql = $default->db;
118 124 // returns all users, the sequence of their collaboration and the time of completion
119   - $sQuery = "SELECT FURL.user_id, FURL.datetime, GFAL.precedence FROM $default->folders_user_roles_table FURL " .
  125 + $sQuery = "SELECT FURL.user_id, FURL.datetime, GFAL.precedence FROM $default->folders_user_roles_table FURL " ./*ok*/
120 126 "INNER JOIN $default->groups_folders_approval_table GFAL ON FURL.group_folder_approval_id = GFAL.id " .
121   - "WHERE FURL.document_id = $iDocumentID " .
  127 + "WHERE FURL.document_id = ? " .
122 128 "ORDER BY GFAL.precedence";
123   - $sql->query($sQuery);
  129 + $aParams = array($iDocumentID);
  130 + $sql->query(array($sQuery, $aParams));
124 131 $iPrecedence = -1;
125 132 $iDateTime = 0;
126 133 $iUserID = -1;
... ... @@ -148,11 +155,13 @@ class DocumentCollaboration {
148 155 //get the current step
149 156 //if the user is assigned to two or more roles, make sure we get the current
150 157 //one by ordering by precedence
151   - $sql->query("SELECT FURL.id AS id, GFAT.precedence " .
  158 + $sQuery = "SELECT FURL.id AS id, GFAT.precedence " ./*ok*/
152 159 "FROM $default->groups_folders_approval_table AS GFAT " .
153 160 "INNER JOIN $default->folders_user_roles_table AS FURL ON GFAT.id = FURL.group_folder_approval_id " .
154   - "WHERE document_id = $iDocumentID AND FURL.user_id = " . $_SESSION["userID"] . " AND done=0 " .
155   - "ORDER BY precedence ASC");
  161 + "WHERE document_id = ? AND FURL.user_id = ? AND done=0 " .
  162 + "ORDER BY precedence ASC";
  163 + $aParams = array($iDocumentID, $_SESSION["userID"]);
  164 + $sql->query(array($sQuery, $aParams));
156 165 if ($sql->next_record()) {
157 166 //set it as done
158 167 $oFolderUserRole = FolderUserRole::get($sql->f("id"));
... ... @@ -162,18 +171,22 @@ class DocumentCollaboration {
162 171 $oFolderUserRole->update();
163 172 //get it's sequence number
164 173 $iCurrentSequenceNumber = $sql->f("precedence");
165   - $sql->query("SELECT MIN(precedence) AS precedence " .
  174 + $sQuery = "SELECT MIN(precedence) AS precedence " . /*ok*/
166 175 "FROM $default->groups_folders_approval_table AS GFAT " .
167 176 "INNER JOIN $default->folders_user_roles_table AS FURL ON GFAT.id = FURL.group_folder_approval_id " .
168   - "WHERE document_id = $iDocumentID AND done = 0");
  177 + "WHERE document_id = ? AND done = 0";
  178 + $aParams = array($iDocumentID);
  179 + $sql->query(array($sQuery, $aParams));
169 180 if ($sql->next_record()) {
170 181 if ($sql->f("precedence") != $iCurrentSequenceNumber) {
171 182 //if there are no concurrent steps outstanding
172 183 $iNextSequenceNumber = $sql->f("precedence");
173   - $sql->query("SELECT FURL.id " .
  184 + $sQuery = "SELECT FURL.id " ./*ok*/
174 185 "FROM $default->groups_folders_approval_table AS GFAT " .
175 186 "INNER JOIN $default->folders_user_roles_table AS FURL ON GFAT.id = FURL.group_folder_approval_id " .
176   - "WHERE document_id = $iDocumentID AND precedence = $iNextSequenceNumber");
  187 + "WHERE document_id = ? AND precedence = ?";
  188 + $aParams = array($iDocumentID, $iNextSequenceNumber);
  189 + $sql->query(array($sQuery, $aParams));
177 190 while ($sql->next_record()) {
178 191 $oFolderUserRole = FolderUserRole::get($sql->f("id"));
179 192 $oFolderUserRole->setActive(true);
... ... @@ -212,9 +225,10 @@ class DocumentCollaboration {
212 225 global $default;
213 226 //only create the documents if they haven't been created
214 227 if ($oFolderUserRole->getDependantDocumentsCreated() == false) {
215   - $sQuery = "SELECT * FROM $default->dependant_document_template_table WHERE group_folder_approval_link_id = " . $oFolderUserRole->getGroupFolderApprovalID();
  228 + $sQuery = "SELECT * FROM $default->dependant_document_template_table WHERE group_folder_approval_link_id = ?";/*ok*/
  229 + $aParams = array($oFolderUserRole->getGroupFolderApprovalID());
216 230 $sql = $default->db;
217   - $sql->query($sQuery);
  231 + $sql->query(array($sQuery, $aParams));
218 232 while ($sql->next_record()) {
219 233 $oDependantDocumentInstance = & new DependantDocumentInstance($sql->f("document_title"), $sql->f("default_user_id"), $sql->f("template_document_id"), $oFolderUserRole->getDocumentID());
220 234 if ($oDependantDocumentInstance->create()) {
... ... @@ -255,16 +269,17 @@ class DocumentCollaboration {
255 269 function rollbackCollaborationStep($iDocumentID, $sComment = "") {
256 270 global $default;
257 271 //get the current sequence number
258   - $sQuery = "SELECT GFAT.precedence, GFAT.folder_id, FURL.id AS furl_id, FURL.document_id AS document_id " .
  272 + $sQuery = "SELECT GFAT.precedence, GFAT.folder_id, FURL.id AS furl_id, FURL.document_id AS document_id " . /*ok*/
259 273 "FROM $default->folders_user_roles_table AS FURL " .
260 274 "INNER JOIN $default->groups_folders_approval_table AS GFAT ON FURL.group_folder_approval_id = GFAT.id " .
261   - "WHERE FURL.document_id = $iDocumentID " .
262   - "AND FURL.user_id = " . $_SESSION["userID"] . " " .
  275 + "WHERE FURL.document_id = ? " .
  276 + "AND FURL.user_id = ? " .
263 277 "AND FURL.active = 1 " .
264 278 "ORDER BY GFAT.precedence ASC";
  279 + $aParams = array($iDocumentID, $_SESSION["userID"]);
265 280  
266 281 $sql = $default->db;
267   - $sql->query($sQuery);
  282 + $sql->query(array($sQuery, $aParams));
268 283 if ($sql->next_record()) {
269 284 $iCurrentSequenceNumber = $sql->f("precedence");
270 285 $iFolderID = $sql->f("folder_id");
... ... @@ -275,11 +290,12 @@ class DocumentCollaboration {
275 290  
276 291 //if there are concurrent collaboration steps and one is rejected, then all
277 292 //must be rolled back, whether they were accepted or not
278   - $sQuery = "SELECT FURL.id, FURL.user_id " .
  293 + $sQuery = "SELECT FURL.id, FURL.user_id " ./*ok*/
279 294 "FROM $default->folders_user_roles_table AS FURL " .
280 295 "INNER JOIN $default->groups_folders_approval_table AS GFAT ON FURL.group_folder_approval_id = GFAT.id " .
281   - "WHERE FURL.document_id = $iDocumentID AND GFAT.precedence = $iCurrentSequenceNumber";
282   - $sql->query($sQuery);
  296 + "WHERE FURL.document_id = ? AND GFAT.precedence = ?";
  297 + $aParams = array($iDocumentID, $iCurrentSequenceNumber);
  298 + $sql->query(array($sQuery, $aParams));
283 299  
284 300 while ($sql->next_record()) {
285 301 //roll back each user's step and then email them to inform them
... ... @@ -311,11 +327,12 @@ class DocumentCollaboration {
311 327 }
312 328  
313 329 //get the previous sequence number
314   - $sQuery = "SELECT COALESCE(MAX(precedence), -1) AS precedence " .
  330 + $sQuery = "SELECT COALESCE(MAX(precedence), -1) AS precedence " ./*ok*/
315 331 "FROM $default->groups_folders_approval_table AS GFAT " .
316   - "WHERE precedence < $iCurrentSequenceNumber";
317   - "AND folder_id = $iFolderID";
318   - $sql->query($sQuery);
  332 + "WHERE precedence < ?";
  333 + "AND folder_id = ?";
  334 + $aParams = array($iCurrentSequenceNumber, $iFolderID);
  335 + $sql->query(array($sQuery, $aParams));
319 336 //there will always be a result in the result set
320 337 $sql->next_record();
321 338 if ($sql->f("precedence") == -1) {
... ... @@ -336,12 +353,13 @@ class DocumentCollaboration {
336 353 }
337 354 } else {
338 355 //there are steps prior to this step
339   - $sQuery = "SELECT FURL.id AS furl_id " .
  356 + $sQuery = "SELECT FURL.id AS furl_id " . /*ok*/
340 357 "FROM $default->folders_user_roles_table AS FURL INNER JOIN $default->groups_folders_approval_table AS GFAT ON FURL.group_folder_approval_id = GFAT.id " .
341   - "WHERE FURL.document_id = $iDocumentID " .
342   - "AND GFAT.precedence = " . $sql->f("precedence");
  358 + "WHERE FURL.document_id = ? " .
  359 + "AND GFAT.precedence = ?";
  360 + $aParams = array($iDocumentID, $sql->f("precedence"));
343 361  
344   - $sql->query($sQuery);
  362 + $sql->query(array($sQuery, $aParams));
345 363 while ($sql->next_record()) {
346 364 //reset all the previous steps and email the users
347 365 //to tell them to re-reperform their steps
... ... @@ -379,9 +397,10 @@ class DocumentCollaboration {
379 397 */
380 398 function documentIsPendingWebPublishing($iDocumentID) {
381 399 global $default;
382   - $sQuery = "SELECT id FROM $default->web_documents_table WHERE document_id = $iDocumentID AND status_id = 1";
  400 + $sQuery = "SELECT id FROM $default->web_documents_table WHERE document_id = ? AND status_id = 1";/*ok*/
  401 + $aParams = array($iDocumentID);
383 402 $sql = $default->db;
384   - $sql->query($sQuery);
  403 + $sql->query(array($sQuery, $aParams));
385 404 if ($sql->next_record()) {
386 405 return true;;
387 406 }
... ... @@ -393,9 +412,10 @@ class DocumentCollaboration {
393 412 */
394 413 function documentIsPublished($iDocumentID) {
395 414 global $default;
396   - $sQuery = "SELECT id FROM $default->web_documents_table WHERE document_id = $iDocumentID AND status_id = 2";
  415 + $sQuery = "SELECT id FROM $default->web_documents_table WHERE document_id = ? AND status_id = 2";/*ok*/
  416 + $aParams = array($iDocumentID);
397 417 $sql = $default->db;
398   - $sql->query($sQuery);
  418 + $sql->query(array($sQuery, $aParams));
399 419 if ($sql->next_record()) {
400 420 return true;;
401 421 }
... ... @@ -410,13 +430,13 @@ class DocumentCollaboration {
410 430 */
411 431 function notifyWebMaster($iDocumentID, $sComment) {
412 432 global $default;
413   - $sQuery = "SELECT WS.web_master_id, WS.web_site_name, WS.web_site_url " .
  433 + $sQuery = "SELECT WS.web_master_id, WS.web_site_name, WS.web_site_url " ./*ok*/
414 434 "FROM $default->web_sites_table AS WS " .
415 435 "INNER JOIN $default->web_documents_table AS WD ON WS.id = WD.web_site_id " .
416   - "WHERE WD.document_id = $iDocumentID";
417   -
  436 + "WHERE WD.document_id = ?";
  437 + $aParams = array($iDocumentID);
418 438 $sql = $default->db;
419   - $sql->query($sQuery);
  439 + $sql->query(array($sQuery, $aParams));
420 440 if ($sql->next_record()) {
421 441 $oUser = User::get($sql->f("web_master_id"));
422 442 if (!($oUser === false)) {
... ...
lib/subscriptions/SubscriptionManager.inc
  View file @88d2fbe
... ... @@ -88,8 +88,8 @@ class SubscriptionManager {
88 88 global $default;
89 89  
90 90 $sql = $default->db;
91   - if ($sql->query("SELECT id FROM " . Subscription::getTableName($iSubscriptionType) . " " .
92   - "WHERE " . Subscription::getIdFieldName($iSubscriptionType) . " = $iExternalID")) {
  91 + if ($sql->query(array("SELECT id FROM " . Subscription::getTableName($iSubscriptionType) . " " ./*ok*/
  92 + "WHERE " . Subscription::getIdFieldName($iSubscriptionType) . " = ?", $iExternalID))) {
93 93 $aSubscriptions = array();
94 94 while ($sql->next_record()) {
95 95 $aSubscriptions[] = & Subscription::get($sql->f("id"), $iSubscriptionType);
... ... @@ -150,8 +150,8 @@ class SubscriptionManager {
150 150 global $default;
151 151  
152 152 $sql = $default->db;
153   - if ($sql->query("SELECT id FROM " . Subscription::getTableName($iSubscriptionType) . " " .
154   - "WHERE user_id = $iUserID")) {
  153 + if ($sql->query(array("SELECT id FROM " . Subscription::getTableName($iSubscriptionType) . " " ./*ok*/
  154 + "WHERE user_id = ?", $iUserID))) {
155 155 $aSubscriptions = array();
156 156 while ($sql->next_record()) {
157 157 $aSubscriptions[] = & Subscription::get($sql->f("id"), $iSubscriptionType);
... ... @@ -184,9 +184,9 @@ class SubscriptionManager {
184 184 global $default;
185 185  
186 186 $sql = $default->db;
187   - if ($sql->query("SELECT id FROM " . Subscription::getTableName($iSubscriptionType) . " " .
188   - "WHERE user_id = $iUserID " .
189   - "AND is_alerted = 1")) {
  187 + if ($sql->query(array("SELECT id FROM " . Subscription::getTableName($iSubscriptionType) . " " ./*ok*/
  188 + "WHERE user_id = ? " .
  189 + "AND is_alerted = 1", $iUserID))) {
190 190 $aSubscriptions = array();
191 191 while ($sql->next_record()) {
192 192 $aSubscriptions[] = & Subscription::get($sql->f("id"), $iSubscriptionType);
... ...
lib/unitmanagement/Unit.inc
  View file @88d2fbe
... ... @@ -192,7 +192,7 @@ class Unit extends KTEntity {
192 192 function & get($iUnitID) {
193 193 global $default;
194 194 $sql = $default->db;
195   - $result = $sql->query("SELECT * FROM $default->units_table WHERE id = $iUnitID");
  195 + $result = $sql->query(array("SELECT * FROM $default->units_table WHERE id = ?", $iUnitID));/*ok*/
196 196 if ($result) {
197 197 if ($sql->next_record()) {
198 198 $oUnit = & new Unit($sql->f("name"));
... ... @@ -213,7 +213,7 @@ class Unit extends KTEntity {
213 213 global $default;
214 214 // check to see if group is linked to a unit
215 215 $sql = $default->db;
216   - $query = "SELECT unit_id FROM ". $default->groups_units_table ." WHERE unit_id = " . $this->iId;
  216 + $query = array("SELECT unit_id FROM ". $default->groups_units_table ." WHERE unit_id = ?", $this->iId);/*ok*/
217 217 $sql->query($query);
218 218 if ($sql->num_rows($sql) > 0) {
219 219 return true;
... ... @@ -262,7 +262,7 @@ class Unit extends KTEntity {
262 262 $aUnitArray;
263 263 settype($aUnitArray, "array");
264 264 $sql = $default->db;
265   - $result = $sql->query("SELECT * FROM " . $default->units_table . (isset($sWhereClause) ? " " . $sWhereClause : ""));
  265 + $result = $sql->query("SELECT * FROM " . $default->units_table . (isset($sWhereClause) ? " " . $sWhereClause : ""));/*wc*/
266 266 if ($result) {
267 267 $iCount = 0;
268 268 while ($sql->next_record()) {
... ...
lib/unitmanagement/UnitOrganisationLink.inc
  View file @88d2fbe
... ... @@ -115,8 +115,9 @@ class UnitOrganisationLink extends KTEntity {
115 115 if ($this->iId < 0) {
116 116  
117 117 $sql = $default->db;
118   - $query = "SELECT unit_id FROM $default->units_organisations_table WHERE unit_id = $this->iUnitID AND organisation_id = $this->iOrgID";
119   - $sql->query($query);
  118 + $query = "SELECT unit_id FROM $default->units_organisations_table WHERE unit_id = ? AND organisation_id = ?";/*ok*/
  119 + $params = array($this->iUnitID, $this->iOrgID);
  120 + $sql->query(array($query, $params));
120 121 $rows = $sql->num_rows($sql);
121 122  
122 123 if ($rows > 0) {
... ... @@ -138,7 +139,7 @@ class UnitOrganisationLink extends KTEntity {
138 139 function & get($iUnitOrganisationLinkID) {
139 140 global $default;
140 141 $sql = $default->db;
141   - $result = $sql->query("SELECT * FROM $default->units_organisations_table WHERE id = $iUnitOrganisationLinkID");
  142 + $result = $sql->query(array("SELECT * FROM $default->units_organisations_table WHERE id = ?", $iUnitOrganisationLinkID));/*ok*/
142 143 if ($result) {
143 144 if ($sql->next_record()) {
144 145 $oUnitOrganisationLink = & new UnitOrganisationLink($sql->f("unit_id"),$sql->f("organisation_id") );
... ... @@ -164,7 +165,7 @@ class UnitOrganisationLink extends KTEntity {
164 165 $aUnitOrganisationLink;
165 166 settype($aUnitOrganisationLink, "array");
166 167 $sql = $default->db;
167   - $result = $sql->query("SELECT * FROM " . $default->units_organisations_table . (isset($sWhereClause) ? " " . $sWhereClause : ""));
  168 + $result = $sql->query("SELECT * FROM " . $default->units_organisations_table . (isset($sWhereClause) ? " " . $sWhereClause : ""));/*wc*/
168 169 if ($result) {
169 170 $iCount = 0;
170 171 while ($sql->next_record()) {
... ... @@ -208,7 +209,7 @@ class UnitOrganisationLink extends KTEntity {
208 209 function getByUnitID($unitId) {
209 210 global $default;
210 211 $sql = $default->db;
211   - $result = $sql->query("SELECT * FROM $default->units_organisations_table WHERE unit_id = $unitId");
  212 + $result = $sql->query(array("SELECT * FROM $default->units_organisations_table WHERE unit_id = ?", $unitId));/*ok*/
212 213 if ($result) {
213 214 if ($sql->next_record()) {
214 215 $oUnitOrganisationLink = & UnitOrganisationLink::get($sql->f("id"));
... ...
lib/users/User.inc
  View file @88d2fbe
... ... @@ -353,7 +353,7 @@ class User extends KTEntity {
353 353 function & get($iUserID) {
354 354 global $default;
355 355 $sql = $default->db;
356   - $result = $sql->query("SELECT * FROM $default->users_table WHERE id = $iUserID");
  356 + $result = $sql->query(array("SELECT * FROM $default->users_table WHERE id = ?", $iUserID));/*ok*/
357 357 if ($result) {
358 358 if ($sql->next_record()) {
359 359 $oUser = & new User($sql->f("username"), $sql->f("name"), $sql->f("password"), $sql->f("quota_max"), $sql->f("email"), $sql->f("mobile"), $sql->f("email_notification"), $sql->f("sms_notification"), $sql->f("ldap_dn"), $sql->f("max_sessions"), $sql->f("language_id"));
... ... @@ -380,7 +380,7 @@ class User extends KTEntity {
380 380 $aUserArray;
381 381 settype($aUserArray, "array");
382 382 $sql = $default->db;
383   - $result = $sql->query("SELECT * FROM " . $default->users_table . (isset($sWhereClause) ? " " . $sWhereClause : ""));
  383 + $result = $sql->query("SELECT * FROM " . $default->users_table . (isset($sWhereClause) ? " " . $sWhereClause : ""));/*wc*/
384 384 if ($result) {
385 385 $iCount = 0;
386 386 while ($sql->next_record()) {
... ... @@ -406,9 +406,9 @@ class User extends KTEntity {
406 406 global $default, $lang_err_database;
407 407  
408 408 $sql = $default->db;
409   - $result = $sql->query("SELECT DISTINCT gul.unit_id FROM $default->users_groups_table ugl " .
  409 + /*ok*/$result = $sql->query(array("SELECT DISTINCT gul.unit_id FROM $default->users_groups_table ugl " .
410 410 "INNER JOIN $default->groups_units_table gul ON ugl.group_id = gul.group_id ".
411   - "WHERE ugl.user_id=$userID");
  411 + "WHERE ugl.user_id = ?", $userID));
412 412 if ($result) {
413 413 $aUnitIDs = array();
414 414 while ($sql->next_record()) {
... ... @@ -430,9 +430,9 @@ class User extends KTEntity {
430 430 global $default, $lang_err_database;
431 431  
432 432 $sql = $default->db;
433   - $result = $sql->query("SELECT DISTINCT gul.unit_id FROM $default->users_groups_table ugl " .
  433 + /*ok*/$result = $sql->query(array("SELECT DISTINCT gul.unit_id FROM $default->users_groups_table ugl " .
434 434 "INNER JOIN $default->groups_units_table gul ON ugl.group_id = gul.group_id ".
435   - "WHERE ugl.user_id=$userID");
  435 + "WHERE ugl.user_id = ?", $userID));
436 436 if ($result) {
437 437 if ($sql->next_record()) {
438 438 return $sql->f("unit_id");
... ... @@ -503,17 +503,17 @@ class User extends KTEntity {
503 503 // then find the group that is unit_admin
504 504 $sql = $default->db;
505 505 $sEmail = "";
506   - if ($sql->query("SELECT group_id FROM $default->groups_units_table GUL " .
  506 + if ($sql->query(array("SELECT group_id FROM $default->groups_units_table GUL " . /*ok*/
507 507 "INNER JOIN $default->groups_table GL on GUL.group_id=GL.id " .
508 508 "WHERE GL.is_unit_admin=1 " .
509   - "AND unit_id=$iUnitID")) {
  509 + "AND unit_id = ?", $iUnitID))) {
510 510 // get the first record
511 511 if ($sql->next_record()) {
512 512 $iGroupID = $sql->f("group_id");
513 513 // then find the first user in this group that has an email address
514   - if ($sql->query("SELECT U.id, U.email FROM $default->users_table U " .
  514 + if ($sql->query(array("SELECT U.id, U.email FROM $default->users_table U " . /*ok*/
515 515 "INNER JOIN $default->users_groups_table UGL on UGL.user_id=U.id " .
516   - "WHERE group_id=$iGroupID")) {
  516 + "WHERE group_id = ?", $iGroupID))) {
517 517 while ($sql->next_record()) {
518 518 if (strlen($sql->f("email")) > 0) {
519 519 return User::get($sql->f("id"));
... ...
lib/web/WebDocument.inc
  View file @88d2fbe
... ... @@ -151,7 +151,7 @@ class WebDocument extends KTEntity {
151 151 global $default, $lang_err_database;
152 152 $aWebDocumentArray = array();
153 153 $sql = $default->db;
154   - $sQuery = "SELECT * FROM " . $default->web_documents_table;
  154 + $sQuery = "SELECT * FROM " . $default->web_documents_table;/*wc*/
155 155 if (isset($sWhereClause)) {
156 156 $sQuery .= " WHERE " . $sWhereClause;
157 157 }
... ...