lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: compatibility with pgsql, replace all addslashes in particular files

Browse Source
This commit is contained in:
Regis Houssin 2011-02-24 18:36:27 +00:00
parent aba9bb9acd
commit 669fef0014
3 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/comm/propal.php
View File

@ -1652,8 +1652,8 @@ else
$pageprev = $page - 1; $pageprev = $page - 1;
$pagenext = $page + 1; $pagenext = $page + 1;
$viewstatut=addslashes($_GET['viewstatut']); $viewstatut=$db->escape($_GET['viewstatut']);
$object_statut = addslashes($_GET['propal_statut']); $object_statut = $db->escape($_GET['propal_statut']);
if($object_statut != '') if($object_statut != '')
$viewstatut=$object_statut; $viewstatut=$object_statut;
@ -1679,17 +1679,17 @@ else
} }
if (!empty($_GET['search_ref'])) if (!empty($_GET['search_ref']))
{ {
$sql.= " AND p.ref LIKE '%".addslashes($_GET['search_ref'])."%'"; $sql.= " AND p.ref LIKE '%".$db->escape($_GET['search_ref'])."%'";
} }
if (!empty($_GET['search_societe'])) if (!empty($_GET['search_societe']))
{ {
$sql.= " AND s.nom LIKE '%".addslashes($_GET['search_societe'])."%'"; $sql.= " AND s.nom LIKE '%".$db->escape($_GET['search_societe'])."%'";
} }
if (!empty($_GET['search_montant_ht'])) if (!empty($_GET['search_montant_ht']))
{ {
$sql.= " AND p.total_ht='".addslashes($_GET['search_montant_ht'])."'"; $sql.= " AND p.total_ht='".$db->escape($_GET['search_montant_ht'])."'";
} }
if ($sall) $sql.= " AND (s.nom like '%".addslashes($sall)."%' OR p.note like '%".addslashes($sall)."%' OR pd.description like '%".addslashes($sall)."%')"; if ($sall) $sql.= " AND (s.nom like '%".$db->escape($sall)."%' OR p.note like '%".$db->escape($sall)."%' OR pd.description like '%".$db->escape($sall)."%')";
if ($socid) $sql.= ' AND s.rowid = '.$socid; if ($socid) $sql.= ' AND s.rowid = '.$socid;
if ($viewstatut <> '') if ($viewstatut <> '')
{ {
@ -1708,7 +1708,7 @@ else
} }
if (dol_strlen($_POST['sf_ref']) > 0) if (dol_strlen($_POST['sf_ref']) > 0)
{ {
$sql.= " AND p.ref like '%".addslashes($_POST["sf_ref"]) . "%'"; $sql.= " AND p.ref like '%".$db->escape($_POST["sf_ref"]) . "%'";
} }
$sql.= ' ORDER BY '.$sortfield.' '.$sortorder.', p.ref DESC'; $sql.= ' ORDER BY '.$sortfield.' '.$sortorder.', p.ref DESC';

3
htdocs/includes/modules/mailings/fraise.modules.php
View File

@ -58,12 +58,13 @@ class mailing_fraise extends MailingTargets
function getSqlArrayForStats() function getSqlArrayForStats()
{ {
global $langs; global $langs;
$langs->load("members"); $langs->load("members");
// Array for requests for statistics board // Array for requests for statistics board
$statssql=array(); $statssql=array();
$statssql[0] ="SELECT '".addslashes($langs->trans("FundationMembers"))."' as label, count(*) as nb"; $statssql[0] ="SELECT '".$this->db->escape($langs->trans("FundationMembers"))."' as label, count(*) as nb";
$statssql[0].=" FROM ".MAIN_DB_PREFIX."adherent where statut = 1"; $statssql[0].=" FROM ".MAIN_DB_PREFIX."adherent where statut = 1";
return $statssql; return $statssql;

2
htdocs/main.inc.php
View File

@ -46,7 +46,7 @@ if (! empty($_SERVER['DOL_TUNING']))
// Forcing parameter setting magic_quotes_gpc and cleaning parameters // Forcing parameter setting magic_quotes_gpc and cleaning parameters
// (Otherwise he would have for each position, condition // (Otherwise he would have for each position, condition
// Reading stripslashes variable according to state get_magic_quotes_gpc). // Reading stripslashes variable according to state get_magic_quotes_gpc).
// Off mode (recommended, you just do addslashes when an insert / update. // Off mode (recommended, you just do $db->escape when an insert / update.
function stripslashes_deep($value) function stripslashes_deep($value)
{ {
return (is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value)); return (is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value));