nupplaPhil/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #5439 from MrPetovan/task/5410-remove-dbesc

Browse source 
Move DBA to src/ part 4.1: Remove dbesc()
This commit is contained in:
Michael Vogel 2018-07-23 21:51:49 +02:00 committed by GitHub
commit 413424064c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
80 changed files with 674 additions and 687 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
include/api.php
View file

@ -525,7 +525,7 @@ function api_get_user(App $a, $contact_id = null)
// Searching for contact URL
if (!is_null($contact_id) && (intval($contact_id) == 0)) {
$user = dbesc(normalise_link($contact_id));
$user = DBA::escape(normalise_link($contact_id));
$url = $user;
$extra_query = "AND `contact`.`nurl` = '%s' ";
if (api_user() !== false) {
@ -535,7 +535,7 @@ function api_get_user(App $a, $contact_id = null)
// Searching for contact id with uid = 0
if (!is_null($contact_id) && (intval($contact_id) != 0)) {
$user = dbesc(api_unique_id_to_nurl(intval($contact_id)));
$user = DBA::escape(api_unique_id_to_nurl(intval($contact_id)));
if ($user == "") {
throw new BadRequestException("User ID ".$contact_id." not found.");
@ -549,7 +549,7 @@ function api_get_user(App $a, $contact_id = null)
}
if (is_null($user) && x($_GET, 'user_id')) {
$user = dbesc(api_unique_id_to_nurl($_GET['user_id']));
$user = DBA::escape(api_unique_id_to_nurl($_GET['user_id']));
if ($user == "") {
throw new BadRequestException("User ID ".$_GET['user_id']." not found.");
@ -562,7 +562,7 @@ function api_get_user(App $a, $contact_id = null)
}
}
if (is_null($user) && x($_GET, 'screen_name')) {
$user = dbesc($_GET['screen_name']);
$user = DBA::escape($_GET['screen_name']);
$extra_query = "AND `contact`.`nick` = '%s' ";
if (api_user() !== false) {
$extra_query .= "AND `contact`.`uid`=".intval(api_user());
@ -570,7 +570,7 @@ function api_get_user(App $a, $contact_id = null)
}
if (is_null($user) && x($_GET, 'profileurl')) {
$user = dbesc(normalise_link($_GET['profileurl']));
$user = DBA::escape(normalise_link($_GET['profileurl']));
$extra_query = "AND `contact`.`nurl` = '%s' ";
if (api_user() !== false) {
$extra_query .= "AND `contact`.`uid`=".intval(api_user());
@ -584,7 +584,7 @@ function api_get_user(App $a, $contact_id = null)
list($user, $null) = explode(".", $a->argv[$argid]);
}
if (is_numeric($user)) {
$user = dbesc(api_unique_id_to_nurl(intval($user)));
$user = DBA::escape(api_unique_id_to_nurl(intval($user)));
if ($user != "") {
$url = $user;
@ -594,7 +594,7 @@ function api_get_user(App $a, $contact_id = null)
}
}
} else {
$user = dbesc($user);
$user = DBA::escape($user);
$extra_query = "AND `contact`.`nick` = '%s' ";
if (api_user() !== false) {
$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
@ -634,7 +634,7 @@ function api_get_user(App $a, $contact_id = null)
$r = [];
if ($url != "") {
$r = q("SELECT * FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' LIMIT 1", dbesc(normalise_link($url)));
$r = q("SELECT * FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' LIMIT 1", DBA::escape(normalise_link($url)));
}
if (DBA::isResult($r)) {
@ -1437,10 +1437,10 @@ function api_users_search($type)
$userlist = [];
if (x($_GET, 'q')) {
$r = q("SELECT id FROM `contact` WHERE `uid` = 0 AND `name` = '%s'", dbesc($_GET["q"]));
$r = q("SELECT id FROM `contact` WHERE `uid` = 0 AND `name` = '%s'", DBA::escape($_GET["q"]));
if (!DBA::isResult($r)) {
$r = q("SELECT `id` FROM `contact` WHERE `uid` = 0 AND `nick` = '%s'", dbesc($_GET["q"]));
$r = q("SELECT `id` FROM `contact` WHERE `uid` = 0 AND `nick` = '%s'", DBA::escape($_GET["q"]));
}
if (DBA::isResult($r)) {
@ -3482,7 +3482,7 @@ function api_direct_messages_new($type)
$r = q(
"SELECT `id`, `nurl`, `network` FROM `contact` WHERE `uid`=%d AND `nick`='%s'",
intval(api_user()),
dbesc($_POST['screen_name'])
DBA::escape($_POST['screen_name'])
);
if (DBA::isResult($r)) {
@ -3579,7 +3579,7 @@ function api_direct_messages_destroy($type)
}
// add parent-uri to sql command if specified by calling app
$sql_extra = ($parenturi != "" ? " AND `parent-uri` = '" . dbesc($parenturi) . "'" : "");
$sql_extra = ($parenturi != "" ? " AND `parent-uri` = '" . DBA::escape($parenturi) . "'" : "");
// get data of the specified message id
$r = q(
@ -3668,13 +3668,13 @@ function api_direct_messages_box($type, $box, $verbose)
// filters
if ($box=="sentbox") {
$sql_extra = "`mail`.`from-url`='" . dbesc($profile_url) . "'";
$sql_extra = "`mail`.`from-url`='" . DBA::escape($profile_url) . "'";
} elseif ($box == "conversation") {
$sql_extra = "`mail`.`parent-uri`='" . dbesc(defaults($_GET, 'uri', '')) . "'";
$sql_extra = "`mail`.`parent-uri`='" . DBA::escape(defaults($_GET, 'uri', '')) . "'";
} elseif ($box == "all") {
$sql_extra = "true";
} elseif ($box == "inbox") {
$sql_extra = "`mail`.`from-url`!='" . dbesc($profile_url) . "'";
$sql_extra = "`mail`.`from-url`!='" . DBA::escape($profile_url) . "'";
}
if ($max_id > 0) {
@ -3684,7 +3684,7 @@ function api_direct_messages_box($type, $box, $verbose)
if ($user_id != "") {
$sql_extra .= ' AND `mail`.`contact-id` = ' . intval($user_id);
} elseif ($screen_name !="") {
$sql_extra .= " AND `contact`.`nick` = '" . dbesc($screen_name). "'";
$sql_extra .= " AND `contact`.`nick` = '" . DBA::escape($screen_name). "'";
}
$r = q(
@ -3847,7 +3847,7 @@ function api_fr_photoalbum_delete($type)
$r = q(
"SELECT DISTINCT `resource-id` FROM `photo` WHERE `uid` = %d AND `album` = '%s'",
intval(api_user()),
dbesc($album)
DBA::escape($album)
);
if (!DBA::isResult($r)) {
throw new BadRequestException("album not available");
@ -4008,8 +4008,8 @@ function api_fr_photo_create_update($type)
$r = q(
"SELECT `id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' AND `album` = '%s'",
intval(api_user()),
dbesc($photo_id),
dbesc($album)
DBA::escape($photo_id),
DBA::escape($album)
);
if (!DBA::isResult($r)) {
throw new BadRequestException("photo not available");
@ -4078,8 +4078,8 @@ function api_fr_photo_create_update($type)
$sql_extra,
DateTimeFormat::utcNow(), // update edited timestamp
intval(api_user()),
dbesc($photo_id),
dbesc($album)
DBA::escape($photo_id),
DBA::escape($album)
);
} else {
$nothingtodo = true;
@ -4132,7 +4132,7 @@ function api_fr_photo_delete($type)
$r = q(
"SELECT `id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'",
intval(api_user()),
dbesc($photo_id)
DBA::escape($photo_id)
);
if (!DBA::isResult($r)) {
throw new BadRequestException("photo not available");
@ -4596,7 +4596,7 @@ function prepare_photo_data($type, $scale, $photo_id)
FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' %s GROUP BY `resource-id`",
$data_sql,
intval(local_user()),
dbesc($photo_id),
DBA::escape($photo_id),
$scale_sql
);
@ -4850,7 +4850,7 @@ function api_get_nick($profile)
$r = q(
"SELECT `nick` FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s'",
dbesc(normalise_link($profile))
DBA::escape(normalise_link($profile))
);
if (DBA::isResult($r)) {
@ -4860,7 +4860,7 @@ function api_get_nick($profile)
if (!$nick == "") {
$r = q(
"SELECT `nick` FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s'",
dbesc(normalise_link($profile))
DBA::escape(normalise_link($profile))
);
if (DBA::isResult($r)) {
@ -5205,7 +5205,7 @@ function api_friendica_group_delete($type)
"SELECT * FROM `group` WHERE `uid` = %d AND `id` = %d AND `name` = '%s'",
intval($uid),
intval($gid),
dbesc($name)
DBA::escape($name)
);
// error message if specified gid is not in database
if (!DBA::isResult($rname)) {
@ -5290,7 +5290,7 @@ function group_create($name, $uid, $users = [])
$rname = q(
"SELECT * FROM `group` WHERE `uid` = %d AND `name` = '%s' AND `deleted` = 0",
intval($uid),
dbesc($name)
DBA::escape($name)
);
// error message if specified group name already exists
if (DBA::isResult($rname)) {
@ -5301,7 +5301,7 @@ function group_create($name, $uid, $users = [])
$rname = q(
"SELECT * FROM `group` WHERE `uid` = %d AND `name` = '%s' AND `deleted` = 1",
intval($uid),
dbesc($name)
DBA::escape($name)
);
// error message if specified group name already exists
if (DBA::isResult($rname)) {
@ -5728,7 +5728,7 @@ function api_friendica_direct_messages_search($type, $box = "")
$r = q(
"SELECT `mail`.*, `contact`.`nurl` AS `contact-url` FROM `mail`,`contact` WHERE `mail`.`contact-id` = `contact`.`id` AND `mail`.`uid`=%d AND `body` LIKE '%s' ORDER BY `mail`.`id` DESC",
intval($uid),
dbesc('%'.$searchstring.'%')
DBA::escape('%'.$searchstring.'%')
);
$profile_url = $user_info["url"];

12
include/dba.php
View file

@ -2,14 +2,6 @@
use Friendica\Database\DBA;
function dbesc($str) {
if (DBA::$connected) {
return(DBA::escape($str));
} else {
return(str_replace("'","\\'",$str));
}
}
/**
* @brief execute SQL query with printf style args - deprecated
*
@ -49,7 +41,3 @@ function q($sql) {
return $data;
}
function dba_timer() {
return microtime(true);
}

30
include/enotify.php
View file

@ -118,7 +118,7 @@ function notification($params)
intval(NOTIFY_TAGSELF),
intval(NOTIFY_COMMENT),
intval(NOTIFY_SHARE),
dbesc($params['link']),
DBA::escape($params['link']),
intval($params['uid'])
);
if ($p && count($p)) {
@ -436,7 +436,7 @@ function notification($params)
$dups = false;
$hash = random_string();
$r = q("SELECT `id` FROM `notify` WHERE `hash` = '%s' LIMIT 1",
dbesc($hash));
DBA::escape($hash));
if (DBA::isResult($r)) {
$dups = true;
}
@ -469,23 +469,23 @@ function notification($params)
// create notification entry in DB
q("INSERT INTO `notify` (`hash`, `name`, `url`, `photo`, `date`, `uid`, `link`, `iid`, `parent`, `type`, `verb`, `otype`, `name_cache`)
values('%s', '%s', '%s', '%s', '%s', %d, '%s', %d, %d, %d, '%s', '%s', '%s')",
dbesc($datarray['hash']),
dbesc($datarray['name']),
dbesc($datarray['url']),
dbesc($datarray['photo']),
dbesc($datarray['date']),
DBA::escape($datarray['hash']),
DBA::escape($datarray['name']),
DBA::escape($datarray['url']),
DBA::escape($datarray['photo']),
DBA::escape($datarray['date']),
intval($datarray['uid']),
dbesc($datarray['link']),
DBA::escape($datarray['link']),
intval($datarray['iid']),
intval($datarray['parent']),
intval($datarray['type']),
dbesc($datarray['verb']),
dbesc($datarray['otype']),
dbesc($datarray["name_cache"])
DBA::escape($datarray['verb']),
DBA::escape($datarray['otype']),
DBA::escape($datarray["name_cache"])
);
$r = q("SELECT `id` FROM `notify` WHERE `hash` = '%s' AND `uid` = %d LIMIT 1",
dbesc($hash),
DBA::escape($hash),
intval($params['uid'])
);
if ($r) {
@ -500,7 +500,7 @@ function notification($params)
$p = q("SELECT `id` FROM `notify` WHERE `type` IN (%d, %d) AND `link` = '%s' AND `uid` = %d ORDER BY `id`",
intval(NOTIFY_TAGSELF),
intval(NOTIFY_COMMENT),
dbesc($params['link']),
DBA::escape($params['link']),
intval($params['uid'])
);
if ($p && (count($p) > 1)) {
@ -519,8 +519,8 @@ function notification($params)
$msg = replace_macros($epreamble, ['$itemlink' => $itemlink]);
$msg_cache = format_notification_message($datarray['name_cache'], strip_tags(BBCode::convert($msg)));
q("UPDATE `notify` SET `msg` = '%s', `msg_cache` = '%s' WHERE `id` = %d AND `uid` = %d",
dbesc($msg),
dbesc($msg_cache),
DBA::escape($msg),
DBA::escape($msg_cache),
intval($notify_id),
intval($params['uid'])
);

2
include/items.php
View file

@ -263,7 +263,7 @@ function consume_feed($xml, $importer, $contact, &$hub, $datedir = 0, $pass = 0)
FROM `contact`
LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`id` = %d AND `user`.`uid` = %d",
dbesc($contact["id"]), dbesc($importer["uid"])
DBA::escape($contact["id"]), DBA::escape($importer["uid"])
);
if (DBA::isResult($r)) {
logger("Now import the DFRN feed");

8
include/security.php
View file

@ -322,9 +322,9 @@ function permissions_sql($owner_id, $remote_verified = false, $groups = null)
)
",
intval($remote_user),
dbesc($gs),
DBA::escape($gs),
intval($remote_user),
dbesc($gs)
DBA::escape($gs)
);
}
}
@ -385,9 +385,9 @@ function item_permissions_sql($owner_id, $remote_verified = false, $groups = nul
AND ( `item`.allow_cid REGEXP '<%d>' OR `item`.allow_gid REGEXP '%s' OR ( `item`.allow_cid = '' AND `item`.allow_gid = '')))))
",
intval($remote_user),
dbesc($gs),
DBA::escape($gs),
intval($remote_user),
dbesc($gs)
DBA::escape($gs)
);
}
}

22
include/text.php
View file

@ -755,9 +755,9 @@ function contact_block() {
AND NOT `pending` AND NOT `hidden` AND NOT `archive`
AND `network` IN ('%s', '%s', '%s')",
intval($a->profile['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_DIASPORA)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_DIASPORA)
);
if (DBA::isResult($r)) {
$total = intval($r[0]['total']);
@ -773,9 +773,9 @@ function contact_block() {
AND `network` IN ('%s', '%s', '%s')
ORDER BY RAND() LIMIT %d",
intval($a->profile['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_DIASPORA),
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_DIASPORA),
intval($shown)
);
if (DBA::isResult($r)) {
@ -784,7 +784,7 @@ function contact_block() {
$contacts[] = $contact["id"];
}
$r = q("SELECT `id`, `uid`, `addr`, `url`, `name`, `thumb`, `network` FROM `contact` WHERE `id` IN (%s)",
dbesc(implode(",", $contacts)));
DBA::escape(implode(",", $contacts)));
if (DBA::isResult($r)) {
$contacts = L10n::tt('%d Contact', '%d Contacts', $total);
@ -1467,7 +1467,7 @@ function generate_user_guid() {
do {
$guid = System::createGUID(32);
$x = q("SELECT `uid` FROM `user` WHERE `guid` = '%s' LIMIT 1",
dbesc($guid)
DBA::escape($guid)
);
if (!DBA::isResult($x)) {
$found = false;
@ -1659,7 +1659,7 @@ function file_tag_file_query($table,$s,$type = 'file') {
} else {
$str = preg_quote('<' . str_replace('%', '%%', file_tag_encode($s)) . '>');
}
return " AND " . (($table) ? dbesc($table) . '.' : '') . "file regexp '" . dbesc($str) . "' ";
return " AND " . (($table) ? DBA::escape($table) . '.' : '') . "file regexp '" . DBA::escape($str) . "' ";
}
// ex. given music,video return <music><video> or [music][video]
@ -1753,7 +1753,7 @@ function file_tag_update_pconfig($uid, $file_old, $file_new, $type = 'file') {
foreach ($deleted_tags as $key => $tag) {
$r = q("SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d",
dbesc($tag),
DBA::escape($tag),
intval(TERM_OBJ_POST),
intval($termtype),
intval($uid));
@ -1819,7 +1819,7 @@ function file_tag_unsave_file($uid, $item_id, $file, $cat = false)
Item::update($fields, ['id' => $item_id]);
$r = q("SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d",
dbesc($file),
DBA::escape($file),
intval(TERM_OBJ_POST),
intval($termtype),
intval($uid)

20
mod/acl.php
View file

@ -36,8 +36,8 @@ function acl_content(App $a)
logger("Searching for ".$search." - type ".$type." conversation ".$conv_id, LOGGER_DEBUG);
if ($search != '') {
$sql_extra = "AND `name` LIKE '%%" . dbesc($search) . "%%'";
$sql_extra2 = "AND (`attag` LIKE '%%" . dbesc($search) . "%%' OR `name` LIKE '%%" . dbesc($search) . "%%' OR `nick` LIKE '%%" . dbesc($search) . "%%')";
$sql_extra = "AND `name` LIKE '%%" . DBA::escape($search) . "%%'";
$sql_extra2 = "AND (`attag` LIKE '%%" . DBA::escape($search) . "%%' OR `name` LIKE '%%" . DBA::escape($search) . "%%' OR `nick` LIKE '%%" . DBA::escape($search) . "%%')";
} else {
/// @TODO Avoid these needless else blocks by putting variable-initialization atop of if()
$sql_extra = $sql_extra2 = '';
@ -84,8 +84,8 @@ function acl_content(App $a)
AND `success_update` >= `failure_update`
AND `network` IN ('%s', '%s') $sql_extra2",
intval(local_user()),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA)
);
$contact_count = (int) $r[0]['c'];
} elseif ($type == 'a') {
@ -143,8 +143,8 @@ function acl_content(App $a)
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_STATUSNET)
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_STATUSNET)
);
} elseif ($type == 'c') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
@ -153,7 +153,7 @@ function acl_content(App $a)
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
dbesc(NETWORK_STATUSNET)
DBA::escape(NETWORK_STATUSNET)
);
} elseif ($type == 'f') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
@ -163,7 +163,7 @@ function acl_content(App $a)
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
dbesc(NETWORK_STATUSNET)
DBA::escape(NETWORK_STATUSNET)
);
} elseif ($type == 'm') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr` FROM `contact`
@ -172,8 +172,8 @@ function acl_content(App $a)
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA)
);
} elseif ($type == 'a') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`

6
mod/admin.php
View file

@ -816,7 +816,7 @@ function admin_page_workerqueue(App $a)
function admin_page_summary(App $a)
{
// are there MyISAM tables in the DB? If so, trigger a warning message
$r = q("SELECT `engine` FROM `information_schema`.`tables` WHERE `engine` = 'myisam' AND `table_schema` = '%s' LIMIT 1", dbesc(DBA::databaseName()));
$r = q("SELECT `engine` FROM `information_schema`.`tables` WHERE `engine` = 'myisam' AND `table_schema` = '%s' LIMIT 1", DBA::escape(DBA::databaseName()));
$showwarning = false;
$warningtext = [];
if (DBA::isResult($r)) {
@ -949,8 +949,8 @@ function admin_page_site_post(App $a)
function update_table($table_name, $fields, $old_url, $new_url)
{
$dbold = dbesc($old_url);
$dbnew = dbesc($new_url);
$dbold = DBA::escape($old_url);
$dbnew = DBA::escape($new_url);
$upd = [];
foreach ($fields as $f) {

2
mod/api.php
View file

@ -20,7 +20,7 @@ function oauth_get_client($request)
$r = q("SELECT `clients`.*
FROM `clients`, `tokens`
WHERE `clients`.`client_id`=`tokens`.`client_id`
AND `tokens`.`id`='%s' AND `tokens`.`scope`='request'", dbesc($token));
AND `tokens`.`id`='%s' AND `tokens`.`scope`='request'", DBA::escape($token));
if (!DBA::isResult($r)) {
return null;

2
mod/attach.php
View file

@ -32,7 +32,7 @@ function attach_init(App $a)
// Now we'll see if we can access the attachment
$r = q("SELECT * FROM `attach` WHERE `id` = '%d' $sql_extra LIMIT 1",
dbesc($item_id)
DBA::escape($item_id)
);
if (!DBA::isResult($r)) {

10
mod/contacts.php
View file

@ -216,11 +216,11 @@ function contacts_post(App $a)
`ffi_keyword_blacklist` = '%s' WHERE `id` = %d AND `uid` = %d",
intval($profile_id),
intval($priority),
dbesc($info),
DBA::escape($info),
intval($hidden),
intval($notify),
intval($fetch_further_information),
dbesc($ffi_keyword_blacklist),
DBA::escape($ffi_keyword_blacklist),
intval($contact_id),
intval(local_user())
);
@ -308,7 +308,7 @@ function _contact_update_profile($contact_id)
$query .= ", ";
}
$query .= "`" . $key . "` = '" . dbesc($value) . "'";
$query .= "`" . $key . "` = '" . DBA::escape($value) . "'";
}
if ($query == "") {
@ -773,12 +773,12 @@ function contacts_content(App $a)
if ($search) {
$searching = true;
$search_hdr = $search;
$search_txt = dbesc(protect_sprintf(preg_quote($search)));
$search_txt = DBA::escape(protect_sprintf(preg_quote($search)));
$sql_extra .= " AND (name REGEXP '$search_txt' OR url REGEXP '$search_txt' OR nick REGEXP '$search_txt') ";
}
if ($nets) {
$sql_extra .= sprintf(" AND network = '%s' ", dbesc($nets));
$sql_extra .= sprintf(" AND network = '%s' ", DBA::escape($nets));
}
$sql_extra2 = ((($sort_type > 0) && ($sort_type <= CONTACT_IS_FRIEND)) ? sprintf(" AND `rel` = %d ", intval($sort_type)) : '');

18
mod/crepair.php
View file

@ -64,15 +64,15 @@ function crepair_post(App $a)
$r = q("UPDATE `contact` SET `name` = '%s', `nick` = '%s', `url` = '%s', `nurl` = '%s', `request` = '%s', `confirm` = '%s', `notify` = '%s', `poll` = '%s', `attag` = '%s' , `remote_self` = %d
WHERE `id` = %d AND `uid` = %d",
dbesc($name),
dbesc($nick),
dbesc($url),
dbesc($nurl),
dbesc($request),
dbesc($confirm),
dbesc($notify),
dbesc($poll),
dbesc($attag),
DBA::escape($name),
DBA::escape($nick),
DBA::escape($url),
DBA::escape($nurl),
DBA::escape($request),
DBA::escape($confirm),
DBA::escape($notify),
DBA::escape($poll),
DBA::escape($attag),
intval($remote_self),
intval($contact['id']),
local_user()

6
mod/delegate.php
View file

@ -110,14 +110,14 @@ function delegate_content(App $a)
AND SUBSTRING_INDEX(`nurl`, '/', 3) = '%s'
AND `uid` = %d
AND `network` = '%s' ",
dbesc(normalise_link(System::baseUrl())),
DBA::escape(normalise_link(System::baseUrl())),
intval(local_user()),
dbesc(NETWORK_DFRN)
DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {
$nicknames = [];
foreach ($r as $rr) {
$nicknames[] = "'" . dbesc(basename($rr['nurl'])) . "'";
$nicknames[] = "'" . DBA::escape(basename($rr['nurl'])) . "'";
}
$nicks = implode(',', $nicknames);

34
mod/dfrn_confirm.php
View file

@ -117,7 +117,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
AND `uid` = %d
AND `duplex` = 0
LIMIT 1",
dbesc($dfrn_id),
DBA::escape($dfrn_id),
intval($cid),
intval($uid)
);
@ -157,7 +157,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
// Save the private key. Send them the public key.
q("UPDATE `contact` SET `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d",
dbesc($private_key),
DBA::escape($private_key),
intval($contact_id),
intval($uid)
);
@ -261,7 +261,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
// birthday paradox - generate new dfrn-id and fall through.
$new_dfrn_id = random_string();
q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
dbesc($new_dfrn_id),
DBA::escape($new_dfrn_id),
intval($contact_id),
intval($uid)
);
@ -324,11 +324,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
`network` = '%s' WHERE `id` = %d
",
intval($new_relation),
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
intval($duplex),
intval($hidden),
dbesc(NETWORK_DFRN),
DBA::escape(NETWORK_DFRN),
intval($contact_id)
);
} else {
@ -372,12 +372,12 @@ function dfrn_confirm_post(App $a, $handsfree = null)
`rel` = %d
WHERE `id` = %d
",
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utcNow()),
dbesc($addr),
dbesc($notify),
dbesc($poll),
dbesc($network),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape($addr),
DBA::escape($notify),
DBA::escape($poll),
DBA::escape($network),
intval($writable),
intval($hidden),
intval($new_relation),
@ -517,8 +517,8 @@ function dfrn_confirm_post(App $a, $handsfree = null)
}
$r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d",
dbesc($decrypted_dfrn_id),
dbesc($dfrn_pubkey),
DBA::escape($decrypted_dfrn_id),
DBA::escape($dfrn_pubkey),
intval($dfrn_record)
);
if (!DBA::isResult($r)) {
@ -568,12 +568,12 @@ function dfrn_confirm_post(App $a, $handsfree = null)
`network` = '%s' WHERE `id` = %d
",
intval($new_relation),
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
intval($duplex),
intval($forum),
intval($prv),
dbesc(NETWORK_DFRN),
DBA::escape(NETWORK_DFRN),
intval($dfrn_record)
);
if (!DBA::isResult($r)) { // indicates schema is messed up or total db failure

16
mod/dfrn_notify.php
View file

@ -74,13 +74,13 @@ function dfrn_notify_post(App $a) {
$sql_extra = '';
switch ($direction) {
case (-1):
$sql_extra = sprintf(" AND ( `issued-id` = '%s' OR `dfrn-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id));
$sql_extra = sprintf(" AND ( `issued-id` = '%s' OR `dfrn-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
break;
case 0:
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
break;
case 1:
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
break;
default:
System::xmlExit(3, 'Invalid direction');
@ -104,7 +104,7 @@ function dfrn_notify_post(App $a) {
LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0
AND `user`.`nickname` = '%s' AND `user`.`account_expired` = 0 AND `user`.`account_removed` = 0 $sql_extra LIMIT 1",
dbesc($a->argv[1])
DBA::escape($a->argv[1])
);
if (!DBA::isResult($r)) {
@ -312,15 +312,15 @@ function dfrn_notify_content(App $a) {
$sql_extra = '';
switch($direction) {
case (-1):
$sql_extra = sprintf(" AND (`issued-id` = '%s' OR `dfrn-id` = '%s') ", dbesc($dfrn_id), dbesc($dfrn_id));
$sql_extra = sprintf(" AND (`issued-id` = '%s' OR `dfrn-id` = '%s') ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
@ -331,7 +331,7 @@ function dfrn_notify_content(App $a) {
$r = q("SELECT `contact`.*, `user`.`nickname`, `user`.`page-flags` FROM `contact` LEFT JOIN `user` ON `user`.`uid` = `contact`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0 AND `user`.`nickname` = '%s'
AND `user`.`account_expired` = 0 AND `user`.`account_removed` = 0 $sql_extra LIMIT 1",
dbesc($a->argv[1])
DBA::escape($a->argv[1])
);
if (!DBA::isResult($r)) {

54
mod/dfrn_poll.php
View file

@ -56,7 +56,7 @@ function dfrn_poll_init(App $a)
$user = '';
if ($a->argc > 1) {
$r = q("SELECT `hidewall`,`nickname` FROM `user` WHERE `user`.`nickname` = '%s' LIMIT 1",
dbesc($a->argv[1])
DBA::escape($a->argv[1])
);
if (!$r) {
System::httpExit(404);
@ -77,15 +77,15 @@ function dfrn_poll_init(App $a)
$sql_extra = '';
switch ($direction) {
case -1:
$sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id));
$sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
@ -97,7 +97,7 @@ function dfrn_poll_init(App $a)
FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0
AND `user`.`nickname` = '%s' $sql_extra LIMIT 1",
dbesc($a->argv[1])
DBA::escape($a->argv[1])
);
if (DBA::isResult($r)) {
@ -129,8 +129,8 @@ function dfrn_poll_init(App $a)
$session_id = session_id();
$expire = time() + 86400;
q("UPDATE `session` SET `expire` = '%s' WHERE `sid` = '%s'",
dbesc($expire),
dbesc($session_id)
DBA::escape($expire),
DBA::escape($session_id)
);
}
}
@ -144,7 +144,7 @@ function dfrn_poll_init(App $a)
if ((strlen($challenge)) && (strlen($sec))) {
DBA::delete('profile_check', ["`expire` < ?", time()]);
$r = q("SELECT * FROM `profile_check` WHERE `sec` = '%s' ORDER BY `expire` DESC LIMIT 1",
dbesc($sec)
DBA::escape($sec)
);
if (!DBA::isResult($r)) {
System::xmlExit(3, 'No ticket');
@ -209,7 +209,7 @@ function dfrn_poll_init(App $a)
DBA::delete('profile_check', ["`expire` < ?", time()]);
$r = q("SELECT * FROM `profile_check` WHERE `dfrn_id` = '%s' ORDER BY `expire` DESC",
dbesc($dfrn_id));
DBA::escape($dfrn_id));
if (DBA::isResult($r)) {
System::xmlExit(1);
return; // NOTREACHED
@ -236,7 +236,7 @@ function dfrn_poll_post(App $a)
DBA::delete('profile_check', ["`expire` < ?", time()]);
$r = q("SELECT * FROM `profile_check` WHERE `sec` = '%s' ORDER BY `expire` DESC LIMIT 1",
dbesc($sec)
DBA::escape($sec)
);
if (!DBA::isResult($r)) {
System::xmlExit(3, 'No ticket');
@ -296,8 +296,8 @@ function dfrn_poll_post(App $a)
}
$r = q("SELECT * FROM `challenge` WHERE `dfrn-id` = '%s' AND `challenge` = '%s' LIMIT 1",
dbesc($dfrn_id),
dbesc($challenge)
DBA::escape($dfrn_id),
DBA::escape($challenge)
);
if (!DBA::isResult($r)) {
@ -312,15 +312,15 @@ function dfrn_poll_post(App $a)
$sql_extra = '';
switch ($direction) {
case -1:
$sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
@ -339,7 +339,7 @@ function dfrn_poll_post(App $a)
if ($type === 'reputation' && strlen($url)) {
$r = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
dbesc($url),
DBA::escape($url),
intval($owner_uid)
);
$reputation = 0;
@ -417,11 +417,11 @@ function dfrn_poll_content(App $a)
if ($type !== 'profile') {
$r = q("INSERT INTO `challenge` ( `challenge`, `dfrn-id`, `expire` , `type`, `last_update` )
VALUES( '%s', '%s', '%s', '%s', '%s' ) ",
dbesc($hash),
dbesc($dfrn_id),
DBA::escape($hash),
DBA::escape($dfrn_id),
intval(time() + 60 ),
dbesc($type),
dbesc($last_update)
DBA::escape($type),
DBA::escape($last_update)
);
}
@ -429,19 +429,19 @@ function dfrn_poll_content(App $a)
switch ($direction) {
case -1:
if ($type === 'profile') {
$sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id));
$sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
} else {
$sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id));
}
$my_id = $dfrn_id;
break;
case 0:
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
@ -455,7 +455,7 @@ function dfrn_poll_content(App $a)
FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0
AND `user`.`nickname` = '%s' $sql_extra LIMIT 1",
dbesc($nickname)
DBA::escape($nickname)
);
if (DBA::isResult($r)) {
$challenge = '';
@ -546,8 +546,8 @@ function dfrn_poll_content(App $a)
$session_id = session_id();
$expire = time() + 86400;
q("UPDATE `session` SET `expire` = '%s' WHERE `sid` = '%s'",
dbesc($expire),
dbesc($session_id)
DBA::escape($expire),
DBA::escape($session_id)
);
}

32
mod/dfrn_request.php
View file

@ -84,7 +84,7 @@ function dfrn_request_post(App $a)
// Lookup the contact based on their URL (which is the only unique thing we have at the moment)
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND NOT `self` LIMIT 1",
intval(local_user()),
dbesc(normalise_link($dfrn_url))
DBA::escape(normalise_link($dfrn_url))
);
if (DBA::isResult($r)) {
@ -137,8 +137,8 @@ function dfrn_request_post(App $a)
VALUES ( %d, '%s', '%s', '%s', '%s', '%s' , '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, %d, %d)",
intval(local_user()),
DateTimeFormat::utcNow(),
dbesc($dfrn_url),
dbesc(normalise_link($dfrn_url)),
DBA::escape($dfrn_url),
DBA::escape(normalise_link($dfrn_url)),
$parms['addr'],
$parms['fn'],
$parms['nick'],
@ -149,7 +149,7 @@ function dfrn_request_post(App $a)
$parms['dfrn-notify'],
$parms['dfrn-poll'],
$parms['dfrn-poco'],
dbesc(NETWORK_DFRN),
DBA::escape(NETWORK_DFRN),
intval($aes_allow),
intval($hidden),
intval($blocked),
@ -163,7 +163,7 @@ function dfrn_request_post(App $a)
$r = q("SELECT `id`, `network` FROM `contact` WHERE `uid` = %d AND `url` = '%s' AND `site-pubkey` = '%s' LIMIT 1",
intval(local_user()),
dbesc($dfrn_url),
DBA::escape($dfrn_url),
$parms['key'] // this was already escaped
);
if (DBA::isResult($r)) {
@ -239,7 +239,7 @@ function dfrn_request_post(App $a)
// Block friend request spam
if ($maxreq) {
$r = q("SELECT * FROM `intro` WHERE `datetime` > '%s' AND `uid` = %d",
dbesc(DateTimeFormat::utc('now - 24 hours')),
DBA::escape(DateTimeFormat::utc('now - 24 hours')),
intval($uid)
);
if (DBA::isResult($r) && count($r) > $maxreq) {
@ -302,7 +302,7 @@ function dfrn_request_post(App $a)
if ($network === NETWORK_DFRN) {
$ret = q("SELECT * FROM `contact` WHERE `uid` = %d AND `url` = '%s' AND `self` = 0 LIMIT 1",
intval($uid),
dbesc($url)
DBA::escape($url)
);
if (DBA::isResult($ret)) {
@ -324,7 +324,7 @@ function dfrn_request_post(App $a)
// There is a contact record but no issued-id, so this
// is a reciprocal introduction from a known contact
$r = q("UPDATE `contact` SET `issued-id` = '%s' WHERE `id` = %d",
dbesc($issued_id),
DBA::escape($issued_id),
intval($contact_record['id'])
);
} else {
@ -376,9 +376,9 @@ function dfrn_request_post(App $a)
`request`, `confirm`, `notify`, `poll`, `poco`, `network`, `blocked`, `pending` )
VALUES ( %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d )",
intval($uid),
dbesc(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
$parms['url'],
dbesc(normalise_link($url)),
DBA::escape(normalise_link($url)),
$parms['addr'],
$parms['fn'],
$parms['nick'],
@ -390,7 +390,7 @@ function dfrn_request_post(App $a)
$parms['dfrn-notify'],
$parms['dfrn-poll'],
$parms['dfrn-poco'],
dbesc(NETWORK_DFRN),
DBA::escape(NETWORK_DFRN),
intval($blocked),
intval($pending)
);
@ -422,9 +422,9 @@ function dfrn_request_post(App $a)
intval($uid),
intval($contact_record['id']),
((x($_POST,'knowyou') && ($_POST['knowyou'] == 1)) ? 1 : 0),
dbesc(notags(trim($_POST['dfrn-request-message']))),
dbesc($hash),
dbesc(DateTimeFormat::utcNow())
DBA::escape(notags(trim($_POST['dfrn-request-message']))),
DBA::escape($hash),
DBA::escape(DateTimeFormat::utcNow())
);
}
@ -534,7 +534,7 @@ function dfrn_request_content(App $a)
// We could just unblock it, but first we have to jump through a few hoops to
// send an email, or even to find out if we need to send an email.
$intro = q("SELECT * FROM `intro` WHERE `hash` = '%s' LIMIT 1",
dbesc($_GET['confirm_key'])
DBA::escape($_GET['confirm_key'])
);
if (DBA::isResult($intro)) {
@ -586,7 +586,7 @@ function dfrn_request_content(App $a)
// in dfrn_confirm_post()
$r = q("UPDATE `intro` SET `blocked` = 0 WHERE `hash` = '%s'",
dbesc($_GET['confirm_key'])
DBA::escape($_GET['confirm_key'])
);
}
}

2
mod/directory.php
View file

@ -60,7 +60,7 @@ function directory_content(App $a)
}
if ($search) {
$search = dbesc($search);
$search = DBA::escape($search);
$sql_extra = " AND ((`profile`.`name` LIKE '%$search%') OR
(`user`.`nickname` LIKE '%$search%') OR

12
mod/dirfind.php
View file

@ -118,9 +118,9 @@ function dirfind_content(App $a, $prefix = "") {
((`last_contact` >= `last_failure`) OR (`updated` >= `last_failure`)) AND
(`url` LIKE '%s' OR `name` LIKE '%s' OR `location` LIKE '%s' OR
`addr` LIKE '%s' OR `about` LIKE '%s' OR `keywords` LIKE '%s') $extra_sql",
dbesc(NETWORK_DFRN), dbesc($ostatus), dbesc($diaspora),
dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)),
dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)));
DBA::escape(NETWORK_DFRN), DBA::escape($ostatus), DBA::escape($diaspora),
DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)),
DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)));
$results = q("SELECT `nurl`
FROM `gcontact`
@ -130,9 +130,9 @@ function dirfind_content(App $a, $prefix = "") {
`addr` LIKE '%s' OR `about` LIKE '%s' OR `keywords` LIKE '%s') $extra_sql
GROUP BY `nurl`
ORDER BY `updated` DESC LIMIT %d, %d",
dbesc(NETWORK_DFRN), dbesc($ostatus), dbesc($diaspora),
dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)),
dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)),
DBA::escape(NETWORK_DFRN), DBA::escape($ostatus), DBA::escape($diaspora),
DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)),
DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)),
intval($startrec), intval($perpage));
$j = new stdClass();
$j->total = $count[0]["total"];

12
mod/fbrowser.php
View file

@ -39,8 +39,8 @@ function fbrowser_content(App $a)
if ($a->argc==2) {
$albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s' ",
intval(local_user()),
dbesc('Contact Photos'),
dbesc(L10n::t('Contact Photos'))
DBA::escape('Contact Photos'),
DBA::escape(L10n::t('Contact Photos'))
);
function _map_folder1($el)
@ -54,7 +54,7 @@ function fbrowser_content(App $a)
$album = "";
if ($a->argc==3) {
$album = hex2bin($a->argv[2]);
$sql_extra = sprintf("AND `album` = '%s' ", dbesc($album));
$sql_extra = sprintf("AND `album` = '%s' ", DBA::escape($album));
$sql_extra2 = "";
$path[]=[$a->argv[2], $album];
}
@ -64,8 +64,8 @@ function fbrowser_content(App $a)
FROM `photo` WHERE `uid` = %d $sql_extra AND `album` != '%s' AND `album` != '%s'
GROUP BY `resource-id` $sql_extra2",
intval(local_user()),
dbesc('Contact Photos'),
dbesc(L10n::t('Contact Photos'))
DBA::escape('Contact Photos'),
DBA::escape(L10n::t('Contact Photos'))
);
function _map_files1($rr)
@ -77,7 +77,7 @@ function fbrowser_content(App $a)
// Take the largest picture that is smaller or equal 640 pixels
$p = q("SELECT `scale` FROM `photo` WHERE `resource-id` = '%s' AND `height` <= 640 AND `width` <= 640 ORDER BY `resource-id`, `scale` LIMIT 1",
dbesc($rr['resource-id']));
DBA::escape($rr['resource-id']));
if ($p) {
$scale = $p[0]["scale"];
} else {

4
mod/follow.php
View file

@ -65,8 +65,8 @@ function follow_content(App $a)
$r = q("SELECT `pending` FROM `contact` WHERE `uid` = %d AND ((`rel` != %d) OR (`network` = '%s')) AND
(`nurl` = '%s' OR `alias` = '%s' OR `alias` = '%s') AND
`network` != '%s' LIMIT 1",
intval(local_user()), dbesc(CONTACT_IS_FOLLOWER), dbesc(NETWORK_DFRN), dbesc(normalise_link($url)),
dbesc(normalise_link($url)), dbesc($url), dbesc(NETWORK_STATUSNET));
intval(local_user()), DBA::escape(CONTACT_IS_FOLLOWER), DBA::escape(NETWORK_DFRN), DBA::escape(normalise_link($url)),
DBA::escape(normalise_link($url)), DBA::escape($url), DBA::escape(NETWORK_STATUSNET));
if ($r) {
if ($r[0]['pending']) {

4
mod/friendica.php
View file

@ -17,12 +17,12 @@ function friendica_init(App $a)
$sql_extra = '';
if (x($a->config, 'admin_nickname')) {
$sql_extra = sprintf(" AND `nickname` = '%s' ", dbesc(Config::get('config', 'admin_nickname')));
$sql_extra = sprintf(" AND `nickname` = '%s' ", DBA::escape(Config::get('config', 'admin_nickname')));
}
if (!empty(Config::get('config', 'admin_email'))) {
$adminlist = explode(",", str_replace(" ", "", Config::get('config', 'admin_email')));
$r = q("SELECT `username`, `nickname` FROM `user` WHERE `email` = '%s' $sql_extra", dbesc($adminlist[0]));
$r = q("SELECT `username`, `nickname` FROM `user` WHERE `email` = '%s' $sql_extra", DBA::escape($adminlist[0]));
$admin = [
'name' => $r[0]['username'],
'profile'=> System::baseUrl() . '/profile/' . $r[0]['nickname'],

16
mod/fsuggest.php
View file

@ -48,21 +48,21 @@ function fsuggest_post(App $a)
VALUES ( %d, %d, '%s','%s','%s','%s','%s','%s')",
intval(local_user()),
intval($contact_id),
dbesc($r[0]['name']),
dbesc($r[0]['url']),
dbesc($r[0]['request']),
dbesc($r[0]['photo']),
dbesc($hash),
dbesc(DateTimeFormat::utcNow())
DBA::escape($r[0]['name']),
DBA::escape($r[0]['url']),
DBA::escape($r[0]['request']),
DBA::escape($r[0]['photo']),
DBA::escape($hash),
DBA::escape(DateTimeFormat::utcNow())
);
$r = q("SELECT `id` FROM `fsuggest` WHERE `note` = '%s' AND `uid` = %d LIMIT 1",
dbesc($hash),
DBA::escape($hash),
intval(local_user())
);
if (DBA::isResult($r)) {
$fsuggest_id = $r[0]['id'];
q("UPDATE `fsuggest` SET `note` = '%s' WHERE `id` = %d AND `uid` = %d",
dbesc($note),
DBA::escape($note),
intval($fsuggest_id),
intval(local_user())
);

2
mod/group.php
View file

@ -61,7 +61,7 @@ function group_post(App $a) {
$groupname = notags(trim($_POST['groupname']));
if ((strlen($groupname)) && ($groupname != $group['name'])) {
$r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d",
dbesc($groupname),
DBA::escape($groupname),
intval(local_user()),
intval($group['id'])
);

4
mod/invite.php
View file

@ -61,8 +61,8 @@ function invite_post(App $a)
$nmessage = str_replace('$invite_code', $code, $message);
$r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ",
dbesc($code),
dbesc(DateTimeFormat::utcNow())
DBA::escape($code),
DBA::escape(DateTimeFormat::utcNow())
);
if (! is_site_admin()) {

10
mod/lockview.php
View file

@ -24,7 +24,7 @@ function lockview_content(App $a) {
killme();
$r = q("SELECT * FROM `%s` WHERE `id` = %d LIMIT 1",
dbesc($type),
DBA::escape($type),
intval($item_id)
);
if (! DBA::isResult($r)) {
@ -57,7 +57,7 @@ function lockview_content(App $a) {
if(count($allowed_groups)) {
$r = q("SELECT `name` FROM `group` WHERE `id` IN ( %s )",
dbesc(implode(', ', $allowed_groups))
DBA::escape(implode(', ', $allowed_groups))
);
if (DBA::isResult($r))
foreach($r as $rr)
@ -65,7 +65,7 @@ function lockview_content(App $a) {
}
if(count($allowed_users)) {
$r = q("SELECT `name` FROM `contact` WHERE `id` IN ( %s )",
dbesc(implode(', ',$allowed_users))
DBA::escape(implode(', ',$allowed_users))
);
if (DBA::isResult($r))
foreach($r as $rr)
@ -75,7 +75,7 @@ function lockview_content(App $a) {
if(count($deny_groups)) {
$r = q("SELECT `name` FROM `group` WHERE `id` IN ( %s )",
dbesc(implode(', ', $deny_groups))
DBA::escape(implode(', ', $deny_groups))
);
if (DBA::isResult($r))
foreach($r as $rr)
@ -83,7 +83,7 @@ function lockview_content(App $a) {
}
if(count($deny_users)) {
$r = q("SELECT `name` FROM `contact` WHERE `id` IN ( %s )",
dbesc(implode(', ',$deny_users))
DBA::escape(implode(', ',$deny_users))
);
if (DBA::isResult($r))
foreach($r as $rr)

6
mod/manage.php
View file

@ -60,14 +60,14 @@ function manage_post(App $a) {
// Check if the target user is one of our children
$r = q("SELECT * FROM `user` WHERE `uid` = %d AND `parent-uid` = %d LIMIT 1",
intval($identity),
dbesc($orig_record['uid'])
DBA::escape($orig_record['uid'])
);
// Check if the target user is one of our siblings
if (!DBA::isResult($r) && ($orig_record['parent-uid'] != 0)) {
$r = q("SELECT * FROM `user` WHERE `uid` = %d AND `parent-uid` = %d LIMIT 1",
intval($identity),
dbesc($orig_record['parent-uid'])
DBA::escape($orig_record['parent-uid'])
);
}
@ -143,7 +143,7 @@ function manage_content(App $a) {
//getting additinal information for each identity
foreach ($identities as $key=>$id) {
$thumb = q("SELECT `thumb` FROM `contact` WHERE `uid` = '%s' AND `self` = 1",
dbesc($id['uid'])
DBA::escape($id['uid'])
);
$identities[$key]['thumb'] = $thumb[0]['thumb'];

4
mod/match.php
View file

@ -2,6 +2,7 @@
/**
* @file mod/match.php
*/
use Friendica\App;
use Friendica\Content\Widget;
use Friendica\Core\Config;
@ -9,7 +10,6 @@ use Friendica\Core\L10n;
use Friendica\Core\System;
use Friendica\Database\DBA;
use Friendica\Model\Contact;
use Friendica\Model\Profile;
use Friendica\Util\Network;
require_once 'include/text.php';
@ -79,7 +79,7 @@ function match_content(App $a)
$match = q(
"SELECT `nurl` FROM `contact` WHERE `uid` = '%d' AND nurl='%s' LIMIT 1",
intval(local_user()),
dbesc($match_nurl)
DBA::escape($match_nurl)
);
if (!count($match)) {

10
mod/message.php
View file

@ -217,14 +217,14 @@ function message_content(App $a)
if (!DBA::isResult($r)) {
$r = q("SELECT `name`, `url`, `id` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' LIMIT 1",
intval(local_user()),
dbesc(normalise_link(base64_decode($a->argv[2])))
DBA::escape(normalise_link(base64_decode($a->argv[2])))
);
}
if (!DBA::isResult($r)) {
$r = q("SELECT `name`, `url`, `id` FROM `contact` WHERE `uid` = %d AND `addr` = '%s' LIMIT 1",
intval(local_user()),
dbesc(base64_decode($a->argv[2]))
DBA::escape(base64_decode($a->argv[2]))
);
}
@ -311,10 +311,10 @@ function message_content(App $a)
$contact_id = $r[0]['contact-id'];
$convid = $r[0]['convid'];
$sql_extra = sprintf(" and `mail`.`parent-uri` = '%s' ", dbesc($r[0]['parent-uri']));
$sql_extra = sprintf(" and `mail`.`parent-uri` = '%s' ", DBA::escape($r[0]['parent-uri']));
if ($convid)
$sql_extra = sprintf(" and ( `mail`.`parent-uri` = '%s' OR `mail`.`convid` = '%d' ) ",
dbesc($r[0]['parent-uri']),
DBA::escape($r[0]['parent-uri']),
intval($convid)
);
@ -332,7 +332,7 @@ function message_content(App $a)
}
$r = q("UPDATE `mail` SET `seen` = 1 WHERE `parent-uri` = '%s' AND `uid` = %d",
dbesc($r[0]['parent-uri']),
DBA::escape($r[0]['parent-uri']),
intval(local_user())
);

2
mod/modexp.php
View file

@ -10,7 +10,7 @@ function modexp_init(App $a) {
$nick = $a->argv[1];
$r = q("SELECT `spubkey` FROM `user` WHERE `nickname` = '%s' LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if (! DBA::isResult($r)) {

4
mod/msearch.php
View file

@ -15,7 +15,7 @@ function msearch_post(App $a) {
killme();
$r = q("SELECT COUNT(*) AS `total` FROM `profile` LEFT JOIN `user` ON `user`.`uid` = `profile`.`uid` WHERE `is-default` = 1 AND `user`.`hidewall` = 0 AND MATCH `pub_keywords` AGAINST ('%s') ",
dbesc($search)
DBA::escape($search)
);
if (DBA::isResult($r))
@ -24,7 +24,7 @@ function msearch_post(App $a) {
$results = [];
$r = q("SELECT `pub_keywords`, `username`, `nickname`, `user`.`uid` FROM `user` LEFT JOIN `profile` ON `user`.`uid` = `profile`.`uid` WHERE `is-default` = 1 AND `user`.`hidewall` = 0 AND MATCH `pub_keywords` AGAINST ('%s') LIMIT %d , %d ",
dbesc($search),
DBA::escape($search),
intval($startrec),
intval($perpage)
);

20
mod/network.php
View file

@ -604,8 +604,8 @@ function networkThreadedView(App $a, $update, $parent)
$sql_post_table = " INNER JOIN `thread` ON `thread`.`iid` = `item`.`parent`";
}
$sql_nets = (($nets) ? sprintf(" AND $sql_table.`network` = '%s' ", dbesc($nets)) : '');
$sql_tag_nets = (($nets) ? sprintf(" AND `item`.`network` = '%s' ", dbesc($nets)) : '');
$sql_nets = (($nets) ? sprintf(" AND $sql_table.`network` = '%s' ", DBA::escape($nets)) : '');
$sql_tag_nets = (($nets) ? sprintf(" AND `item`.`network` = '%s' ", DBA::escape($nets)) : '');
if ($gid) {
$group = DBA::selectFirst('group', ['name'], ['id' => $gid, 'uid' => local_user()]);
@ -680,11 +680,11 @@ function networkThreadedView(App $a, $update, $parent)
if ($datequery) {
$sql_extra3 .= protect_sprintf(sprintf(" AND $sql_table.created <= '%s' ",
dbesc(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
DBA::escape(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
}
if ($datequery2) {
$sql_extra3 .= protect_sprintf(sprintf(" AND $sql_table.created >= '%s' ",
dbesc(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
DBA::escape(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
}
if ($conv) {
@ -703,7 +703,7 @@ function networkThreadedView(App $a, $update, $parent)
$sql_order = "$sql_table.$ordering";
if (x($_GET, 'offset')) {
$sql_range = sprintf(" AND $sql_order <= '%s'", dbesc($_GET['offset']));
$sql_range = sprintf(" AND $sql_order <= '%s'", DBA::escape($_GET['offset']));
} else {
$sql_range = '';
}
@ -716,7 +716,7 @@ function networkThreadedView(App $a, $update, $parent)
case 'received':
if ($last_received != '') {
$last_date = $last_received;
$sql_range .= sprintf(" AND $sql_table.`received` < '%s'", dbesc($last_received));
$sql_range .= sprintf(" AND $sql_table.`received` < '%s'", DBA::escape($last_received));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
@ -724,7 +724,7 @@ function networkThreadedView(App $a, $update, $parent)
case 'commented':
if ($last_commented != '') {
$last_date = $last_commented;
$sql_range .= sprintf(" AND $sql_table.`commented` < '%s'", dbesc($last_commented));
$sql_range .= sprintf(" AND $sql_table.`commented` < '%s'", DBA::escape($last_commented));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
@ -732,14 +732,14 @@ function networkThreadedView(App $a, $update, $parent)
case 'created':
if ($last_created != '') {
$last_date = $last_created;
$sql_range .= sprintf(" AND $sql_table.`created` < '%s'", dbesc($last_created));
$sql_range .= sprintf(" AND $sql_table.`created` < '%s'", DBA::escape($last_created));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
break;
case 'id':
if (($last_id > 0) && ($sql_table == '`thread`')) {
$sql_range .= sprintf(" AND $sql_table.`iid` < '%s'", dbesc($last_id));
$sql_range .= sprintf(" AND $sql_table.`iid` < '%s'", DBA::escape($last_id));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
@ -902,7 +902,7 @@ function networkThreadedView(App $a, $update, $parent)
$condition = ['unseen' => true, 'uid' => local_user()];
networkSetSeen($condition);
} elseif ($parents_str) {
$condition = ["`uid` = ? AND `unseen` AND `parent` IN (" . dbesc($parents_str) . ")", local_user()];
$condition = ["`uid` = ? AND `unseen` AND `parent` IN (" . DBA::escape($parents_str) . ")", local_user()];
networkSetSeen($condition);
}

6
mod/noscrape.php
View file

@ -61,9 +61,9 @@ function noscrape_init(App $a)
$r = q("SELECT COUNT(*) AS `total` FROM `contact` WHERE `uid` = %d AND `self` = 0 AND `blocked` = 0 and `pending` = 0 AND `hidden` = 0 AND `archive` = 0
AND `network` IN ('%s', '%s', '%s', '')",
intval($a->profile['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS)
);
if (DBA::isResult($r)) {
$json_info["contacts"] = intval($r[0]['total']);

2
mod/openid.php
View file

@ -41,7 +41,7 @@ function openid_content(App $a) {
AND `blocked` = 0 AND `account_expired` = 0
AND `account_removed` = 0 AND `verified` = 1
LIMIT 1",
dbesc($authid), dbesc(normalise_openid($authid))
DBA::escape($authid), DBA::escape(normalise_openid($authid))
);
if (DBA::isResult($r)) {

4
mod/photo.php
View file

@ -107,7 +107,7 @@ function photo_init(App $a)
// check if the photo exists and get the owner of the photo
$r = q("SELECT `uid` FROM `photo` WHERE `resource-id` = '%s' LIMIT 1",
dbesc($photo),
DBA::escape($photo),
intval($resolution)
);
if (DBA::isResult($r)) {
@ -115,7 +115,7 @@ function photo_init(App $a)
// Now we'll see if we can access the photo
$r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` <= %d $sql_extra ORDER BY scale DESC LIMIT 1",
dbesc($photo),
DBA::escape($photo),
intval($resolution)
);
if (DBA::isResult($r)) {

78
mod/photos.php
View file

@ -45,7 +45,7 @@ function photos_init(App $a) {
if ($a->argc > 1) {
$nick = $a->argv[1];
$user = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `blocked` = 0 LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if (!DBA::isResult($user)) {
@ -198,7 +198,7 @@ function photos_post(App $a)
}
$r = q("SELECT `album` FROM `photo` WHERE `album` = '%s' AND `uid` = %d",
dbesc($album),
DBA::escape($album),
intval($page_owner_uid)
);
if (!DBA::isResult($r)) {
@ -216,8 +216,8 @@ function photos_post(App $a)
$newalbum = notags(trim($_POST['albumname']));
if ($newalbum != $album) {
q("UPDATE `photo` SET `album` = '%s' WHERE `album` = '%s' AND `uid` = %d",
dbesc($newalbum),
dbesc($album),
DBA::escape($newalbum),
DBA::escape($album),
intval($page_owner_uid)
);
// Update the photo albums cache
@ -262,17 +262,17 @@ function photos_post(App $a)
$r = q("SELECT distinct(`resource-id`) as `rid` FROM `photo` WHERE `contact-id` = %d AND `uid` = %d AND `album` = '%s'",
intval($visitor),
intval($page_owner_uid),
dbesc($album)
DBA::escape($album)
);
} else {
$r = q("SELECT distinct(`resource-id`) as `rid` FROM `photo` WHERE `uid` = %d AND `album` = '%s'",
intval(local_user()),
dbesc($album)
DBA::escape($album)
);
}
if (DBA::isResult($r)) {
foreach ($r as $rr) {
$res[] = "'" . dbesc($rr['rid']) . "'" ;
$res[] = "'" . DBA::escape($rr['rid']) . "'" ;
}
} else {
goaway($_SESSION['photo_return']);
@ -327,19 +327,19 @@ function photos_post(App $a)
$r = q("SELECT `id`, `resource-id` FROM `photo` WHERE `contact-id` = %d AND `uid` = %d AND `resource-id` = '%s' LIMIT 1",
intval($visitor),
intval($page_owner_uid),
dbesc($a->argv[2])
DBA::escape($a->argv[2])
);
} else {
$r = q("SELECT `id`, `resource-id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' LIMIT 1",
intval(local_user()),
dbesc($a->argv[2])
DBA::escape($a->argv[2])
);
}
if (DBA::isResult($r)) {
q("DELETE FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'",
intval($page_owner_uid),
dbesc($r[0]['resource-id'])
DBA::escape($r[0]['resource-id'])
);
Item::deleteForUser(['resource-id' => $r[0]['resource-id'], 'uid' => $page_owner_uid], $page_owner_uid);
@ -374,7 +374,7 @@ function photos_post(App $a)
logger('rotate');
$r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 0 LIMIT 1",
dbesc($resource_id),
DBA::escape($resource_id),
intval($page_owner_uid)
);
@ -389,10 +389,10 @@ function photos_post(App $a)
$height = $image->getHeight();
$x = q("UPDATE `photo` SET `data` = '%s', `height` = %d, `width` = %d WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 0",
dbesc($image->asString()),
DBA::escape($image->asString()),
intval($height),
intval($width),
dbesc($resource_id),
DBA::escape($resource_id),
intval($page_owner_uid)
);
@ -402,10 +402,10 @@ function photos_post(App $a)
$height = $image->getHeight();
$x = q("UPDATE `photo` SET `data` = '%s', `height` = %d, `width` = %d WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 1",
dbesc($image->asString()),
DBA::escape($image->asString()),
intval($height),
intval($width),
dbesc($resource_id),
DBA::escape($resource_id),
intval($page_owner_uid)
);
}
@ -416,10 +416,10 @@ function photos_post(App $a)
$height = $image->getHeight();
$x = q("UPDATE `photo` SET `data` = '%s', `height` = %d, `width` = %d WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 2",
dbesc($image->asString()),
DBA::escape($image->asString()),
intval($height),
intval($width),
dbesc($resource_id),
DBA::escape($resource_id),
intval($page_owner_uid)
);
}
@ -428,19 +428,19 @@ function photos_post(App $a)
}
$p = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d ORDER BY `scale` DESC",
dbesc($resource_id),
DBA::escape($resource_id),
intval($page_owner_uid)
);
if (DBA::isResult($p)) {
$ext = $phototypes[$p[0]['type']];
$r = q("UPDATE `photo` SET `desc` = '%s', `album` = '%s', `allow_cid` = '%s', `allow_gid` = '%s', `deny_cid` = '%s', `deny_gid` = '%s' WHERE `resource-id` = '%s' AND `uid` = %d",
dbesc($desc),
dbesc($albname),
dbesc($str_contact_allow),
dbesc($str_group_allow),
dbesc($str_contact_deny),
dbesc($str_group_deny),
dbesc($resource_id),
DBA::escape($desc),
DBA::escape($albname),
DBA::escape($str_contact_allow),
DBA::escape($str_group_allow),
DBA::escape($str_contact_deny),
DBA::escape($str_group_deny),
DBA::escape($resource_id),
intval($page_owner_uid)
);
@ -554,15 +554,15 @@ function photos_post(App $a)
//select someone from this user's contacts by name
$r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
dbesc($newname),
DBA::escape($newname),
intval($page_owner_uid)
);
if (!DBA::isResult($r)) {
//select someone by attag or nick and the name passed in
$r = q("SELECT * FROM `contact` WHERE `attag` = '%s' OR `nick` = '%s' AND `uid` = %d ORDER BY `attag` DESC LIMIT 1",
dbesc($name),
dbesc($name),
DBA::escape($name),
DBA::escape($name),
intval($page_owner_uid)
);
}
@ -707,7 +707,7 @@ function photos_post(App $a)
*/
$r = q("SELECT * FROM `photo` WHERE `album` = '%s' AND `uid` = %d AND `created` > UTC_TIMESTAMP() - INTERVAL 3 HOUR ",
dbesc($album),
DBA::escape($album),
intval($page_owner_uid)
);
@ -1111,7 +1111,7 @@ function photos_content(App $a)
$r = q("SELECT `resource-id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` = '%s'
AND `scale` <= 4 $sql_extra GROUP BY `resource-id`",
intval($owner_uid),
dbesc($album)
DBA::escape($album)
);
if (DBA::isResult($r)) {
$a->set_pager_total(count($r));
@ -1132,7 +1132,7 @@ function photos_content(App $a)
FROM `photo` WHERE `uid` = %d AND `album` = '%s'
AND `scale` <= 4 $sql_extra GROUP BY `resource-id` ORDER BY `created` $order LIMIT %d , %d",
intval($owner_uid),
dbesc($album),
DBA::escape($album),
intval($a->pager['start']),
intval($a->pager['itemspage'])
);
@ -1216,14 +1216,14 @@ function photos_content(App $a)
$ph = q("SELECT * FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'
$sql_extra ORDER BY `scale` ASC ",
intval($owner_uid),
dbesc($datum)
DBA::escape($datum)
);
if (!DBA::isResult($ph)) {
$ph = q("SELECT `id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'
LIMIT 1",
intval($owner_uid),
dbesc($datum)
DBA::escape($datum)
);
if (DBA::isResult($ph)) {
notice(L10n::t('Permission denied. Access to this item may be restricted.'));
@ -1252,7 +1252,7 @@ function photos_content(App $a)
$prvnxt = q("SELECT `resource-id` FROM `photo` WHERE `album` = '%s' AND `uid` = %d AND `scale` = 0
$sql_extra ORDER BY `created` $order ",
dbesc($ph[0]['album']),
DBA::escape($ph[0]['album']),
intval($owner_uid)
);
@ -1347,7 +1347,7 @@ function photos_content(App $a)
/// @todo Rewrite this query. To do so, $sql_extra must be changed
$linked_items = q("SELECT `id` FROM `item` WHERE `resource-id` = '%s' $sql_extra LIMIT 1",
dbesc($datum)
DBA::escape($datum)
);
$map = null;
@ -1615,8 +1615,8 @@ function photos_content(App $a)
$r = q("SELECT `resource-id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s'
$sql_extra GROUP BY `resource-id`",
intval($a->data['user']['uid']),
dbesc('Contact Photos'),
dbesc(L10n::t('Contact Photos'))
DBA::escape('Contact Photos'),
DBA::escape(L10n::t('Contact Photos'))
);
if (DBA::isResult($r)) {
@ -1630,8 +1630,8 @@ function photos_content(App $a)
WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s'
$sql_extra GROUP BY `resource-id` ORDER BY `created` DESC LIMIT %d , %d",
intval($a->data['user']['uid']),
dbesc('Contact Photos'),
dbesc(L10n::t('Contact Photos')),
DBA::escape('Contact Photos'),
DBA::escape(L10n::t('Contact Photos')),
intval($a->pager['start']),
intval($a->pager['itemspage'])
);

10
mod/ping.php
View file

@ -197,7 +197,7 @@ function ping_init(App $a)
"SELECT `id`, `from-name`, `from-url`, `from-photo`, `created` FROM `mail`
WHERE `uid` = %d AND `seen` = 0 AND `from-url` != '%s' ",
intval(local_user()),
dbesc($myurl)
DBA::escape($myurl)
);
$mail_count = count($mails);
@ -221,8 +221,8 @@ function ping_init(App $a)
WHERE `event`.`uid` = %d AND `start` < '%s' AND `finish` > '%s' and `ignore` = 0
ORDER BY `start` ASC ",
intval(local_user()),
dbesc(DateTimeFormat::utc('now + 7 days')),
dbesc(DateTimeFormat::utcNow())
DBA::escape(DateTimeFormat::utc('now + 7 days')),
DBA::escape(DateTimeFormat::utcNow())
);
if (DBA::isResult($ev)) {
Cache::set($cachekey, $ev, CACHE_HOUR);
@ -481,8 +481,8 @@ function ping_get_notifications($uid)
q(
"UPDATE `notify` SET `name_cache` = '%s', `msg_cache` = '%s' WHERE `id` = %d",
dbesc($notification["name"]),
dbesc($notification["message"]),
DBA::escape($notification["name"]),
DBA::escape($notification["message"]),
intval($notification["id"])
);
}

34
mod/poco.php
View file

@ -65,7 +65,7 @@ function poco_init(App $a) {
if (! $system_mode && ! $global) {
$users = q("SELECT `user`.*,`profile`.`hide-friends` from user left join profile on `user`.`uid` = `profile`.`uid`
where `user`.`nickname` = '%s' and `profile`.`is-default` = 1 limit 1",
dbesc($user)
DBA::escape($user)
);
if (! DBA::isResult($users) || $users[0]['hidewall'] || $users[0]['hide-friends']) {
System::httpExit(404);
@ -88,10 +88,10 @@ function poco_init(App $a) {
}
if ($global) {
$contacts = q("SELECT count(*) AS `total` FROM `gcontact` WHERE `updated` >= '%s' AND `updated` >= `last_failure` AND NOT `hide` AND `network` IN ('%s', '%s', '%s')",
dbesc($update_limit),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS)
DBA::escape($update_limit),
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS)
);
} elseif ($system_mode) {
$contacts = q("SELECT count(*) AS `total` FROM `contact` WHERE `self` = 1
@ -101,10 +101,10 @@ function poco_init(App $a) {
AND (`success_update` >= `failure_update` OR `last-item` >= `failure_update`)
AND `network` IN ('%s', '%s', '%s', '%s') $sql_extra",
intval($user['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_STATUSNET)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_STATUSNET)
);
}
if (DBA::isResult($contacts)) {
@ -123,10 +123,10 @@ function poco_init(App $a) {
logger("Start global query", LOGGER_DEBUG);
$contacts = q("SELECT * FROM `gcontact` WHERE `updated` > '%s' AND NOT `hide` AND `network` IN ('%s', '%s', '%s') AND `updated` > `last_failure`
ORDER BY `updated` DESC LIMIT %d, %d",
dbesc($update_limit),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS),
DBA::escape($update_limit),
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS),
intval($startIndex),
intval($itemsPerPage)
);
@ -148,10 +148,10 @@ function poco_init(App $a) {
AND (`success_update` >= `failure_update` OR `last-item` >= `failure_update`)
AND `network` IN ('%s', '%s', '%s', '%s') $sql_extra LIMIT %d, %d",
intval($user['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_STATUSNET),
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_STATUSNET),
intval($startIndex),
intval($itemsPerPage)
);

8
mod/profile.php
View file

@ -257,19 +257,19 @@ function profile_content(App $a, $update = 0)
if (x($category)) {
$sql_post_table = sprintf("INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ",
dbesc(protect_sprintf($category)), intval(TERM_OBJ_POST), intval(TERM_CATEGORY), intval($a->profile['profile_uid']));
DBA::escape(protect_sprintf($category)), intval(TERM_OBJ_POST), intval(TERM_CATEGORY), intval($a->profile['profile_uid']));
}
if (x($hashtags)) {
$sql_post_table .= sprintf("INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ",
dbesc(protect_sprintf($hashtags)), intval(TERM_OBJ_POST), intval(TERM_HASHTAG), intval($a->profile['profile_uid']));
DBA::escape(protect_sprintf($hashtags)), intval(TERM_OBJ_POST), intval(TERM_HASHTAG), intval($a->profile['profile_uid']));
}
if ($datequery) {
$sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` <= '%s' ", dbesc(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
$sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` <= '%s' ", DBA::escape(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
}
if ($datequery2) {
$sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` >= '%s' ", dbesc(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
$sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` >= '%s' ", DBA::escape(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
}
// Belongs the profile page to a forum?

14
mod/profile_photo.php
View file

@ -69,8 +69,8 @@ function profile_photo_post(App $a)
$srcW = $_POST['xfinal'] - $srcX;
$srcH = $_POST['yfinal'] - $srcY;
$r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = %d LIMIT 1", dbesc($image_id),
dbesc(local_user()), intval($scale));
$r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = %d LIMIT 1", DBA::escape($image_id),
DBA::escape(local_user()), intval($scale));
$url = System::baseUrl() . '/profile/' . $a->user['nickname'];
if (DBA::isResult($r)) {
@ -109,12 +109,12 @@ function profile_photo_post(App $a)
if ($is_default_profile) {
$r = q("UPDATE `photo` SET `profile` = 0 WHERE `profile` = 1 AND `resource-id` != '%s' AND `uid` = %d",
dbesc($base_image['resource-id']), intval(local_user())
DBA::escape($base_image['resource-id']), intval(local_user())
);
} else {
$r = q("update profile set photo = '%s', thumb = '%s' where id = %d and uid = %d",
dbesc(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-4.' . $Image->getExt()),
dbesc(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-5.' . $Image->getExt()),
DBA::escape(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-4.' . $Image->getExt()),
DBA::escape(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-5.' . $Image->getExt()),
intval($_REQUEST['profile']), intval(local_user())
);
}
@ -191,7 +191,7 @@ function profile_photo_content(App $a)
$resource_id = $a->argv[2];
//die(":".local_user());
$r = q("SELECT * FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' ORDER BY `scale` ASC", intval(local_user()),
dbesc($resource_id)
DBA::escape($resource_id)
);
if (!DBA::isResult($r)) {
@ -212,7 +212,7 @@ function profile_photo_content(App $a)
$r = q("UPDATE `photo` SET `profile`=0 WHERE `profile`=1 AND `uid`=%d", intval(local_user()));
$r = q("UPDATE `photo` SET `profile`=1 WHERE `uid` = %d AND `resource-id` = '%s'", intval(local_user()),
dbesc($resource_id)
DBA::escape($resource_id)
);
Contact::updateSelfFromUserID(local_user(), true);

86
mod/profiles.php
View file

@ -78,15 +78,15 @@ function profiles_init(App $a) {
$r2 = q("INSERT INTO `profile` (`uid` , `profile-name` , `name`, `photo`, `thumb`)
VALUES ( %d, '%s', '%s', '%s', '%s' )",
intval(local_user()),
dbesc($name),
dbesc($r1[0]['name']),
dbesc($r1[0]['photo']),
dbesc($r1[0]['thumb'])
DBA::escape($name),
DBA::escape($r1[0]['name']),
DBA::escape($r1[0]['photo']),
DBA::escape($r1[0]['thumb'])
);
$r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
intval(local_user()),
dbesc($name)
DBA::escape($name)
);
info(L10n::t('New profile created.') . EOL);
@ -120,13 +120,13 @@ function profiles_init(App $a) {
$r1[0]['is-default'] = 0;
$r1[0]['publish'] = 0;
$r1[0]['net-publish'] = 0;
$r1[0]['profile-name'] = dbesc($name);
$r1[0]['profile-name'] = DBA::escape($name);
DBA::insert('profile', $r1[0]);
$r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
intval(local_user()),
dbesc($name)
DBA::escape($name)
);
info(L10n::t('New profile created.') . EOL);
if ((DBA::isResult($r3)) && (count($r3) == 1)) {
@ -283,12 +283,12 @@ function profiles_post(App $a) {
$newname = $lookup;
$r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
dbesc($newname),
DBA::escape($newname),
intval(local_user())
);
if (! DBA::isResult($r)) {
$r = q("SELECT * FROM `contact` WHERE `nick` = '%s' AND `uid` = %d LIMIT 1",
dbesc($lookup),
DBA::escape($lookup),
intval(local_user())
);
}
@ -440,39 +440,39 @@ function profiles_post(App $a) {
`education` = '%s',
`hide-friends` = %d
WHERE `id` = %d AND `uid` = %d",
dbesc($profile_name),
dbesc($name),
dbesc($pdesc),
dbesc($gender),
dbesc($dob),
dbesc($address),
dbesc($locality),
dbesc($region),
dbesc($postal_code),
dbesc($country_name),
dbesc($marital),
dbesc($with),
dbesc($howlong),
dbesc($sexual),
dbesc($xmpp),
dbesc($homepage),
dbesc($hometown),
dbesc($politic),
dbesc($religion),
dbesc($pub_keywords),
dbesc($prv_keywords),
dbesc($likes),
dbesc($dislikes),
dbesc($about),
dbesc($interest),
dbesc($contact),
dbesc($music),
dbesc($book),
dbesc($tv),
dbesc($film),
dbesc($romance),
dbesc($work),
dbesc($education),
DBA::escape($profile_name),
DBA::escape($name),
DBA::escape($pdesc),
DBA::escape($gender),
DBA::escape($dob),
DBA::escape($address),
DBA::escape($locality),
DBA::escape($region),
DBA::escape($postal_code),
DBA::escape($country_name),
DBA::escape($marital),
DBA::escape($with),
DBA::escape($howlong),
DBA::escape($sexual),
DBA::escape($xmpp),
DBA::escape($homepage),
DBA::escape($hometown),
DBA::escape($politic),
DBA::escape($religion),
DBA::escape($pub_keywords),
DBA::escape($prv_keywords),
DBA::escape($likes),
DBA::escape($dislikes),
DBA::escape($about),
DBA::escape($interest),
DBA::escape($contact),
DBA::escape($music),
DBA::escape($book),
DBA::escape($tv),
DBA::escape($film),
DBA::escape($romance),
DBA::escape($work),
DBA::escape($education),
intval($hide_friends),
intval($a->argv[1]),
intval(local_user())
@ -486,7 +486,7 @@ function profiles_post(App $a) {
if ($is_default) {
if ($namechanged) {
$r = q("UPDATE `user` set `username` = '%s' where `uid` = %d",
dbesc($name),
DBA::escape($name),
intval(local_user())
);
}

4
mod/profperm.php
View file

@ -47,7 +47,7 @@ function profperm_content(App $a) {
if(($a->argc > 2) && intval($a->argv[1]) && intval($a->argv[2])) {
$r = q("SELECT `id` FROM `contact` WHERE `blocked` = 0 AND `pending` = 0 AND `self` = 0
AND `network` = '%s' AND `id` = %d AND `uid` = %d LIMIT 1",
dbesc(NETWORK_DFRN),
DBA::escape(NETWORK_DFRN),
intval($a->argv[2]),
intval(local_user())
);
@ -144,7 +144,7 @@ function profperm_content(App $a) {
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `blocked` = 0 and `pending` = 0 and `self` = 0
AND `network` = '%s' ORDER BY `name` ASC",
intval(local_user()),
dbesc(NETWORK_DFRN)
DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {

16
mod/register.php
View file

@ -85,7 +85,7 @@ function register_post(App $a)
if (intval(Config::get('config', 'register_policy')) === REGISTER_OPEN) {
if ($using_invites && $invite_id) {
q("delete * from register where hash = '%s' limit 1", dbesc($invite_id));
q("delete * from register where hash = '%s' limit 1", DBA::escape($invite_id));
PConfig::set($user['uid'], 'system', 'invites_remaining', $num_invites);
}
@ -117,22 +117,22 @@ function register_post(App $a)
$hash = random_string();
$r = q("INSERT INTO `register` ( `hash`, `created`, `uid`, `password`, `language`, `note` ) VALUES ( '%s', '%s', %d, '%s', '%s', '%s' ) ",
dbesc($hash),
dbesc(DateTimeFormat::utcNow()),
DBA::escape($hash),
DBA::escape(DateTimeFormat::utcNow()),
intval($user['uid']),
dbesc($result['password']),
dbesc(Config::get('system', 'language')),
dbesc($_POST['permonlybox'])
DBA::escape($result['password']),
DBA::escape(Config::get('system', 'language')),
DBA::escape($_POST['permonlybox'])
);
// invite system
if ($using_invites && $invite_id) {
q("DELETE * FROM `register` WHERE `hash` = '%s' LIMIT 1", dbesc($invite_id));
q("DELETE * FROM `register` WHERE `hash` = '%s' LIMIT 1", DBA::escape($invite_id));
PConfig::set($user['uid'], 'system', 'invites_remaining', $num_invites);
}
// send email to admins
$admin_mail_list = "'" . implode("','", array_map("dbesc", explode(",", str_replace(" ", "", Config::get('config', 'admin_email'))))) . "'";
$admin_mail_list = "'" . implode("','", array_map(['Friendica\Database\DBA', 'escape'], explode(",", str_replace(" ", "", Config::get('config', 'admin_email'))))) . "'";
$adminlist = q("SELECT uid, language, email FROM user WHERE email IN (%s)",
$admin_mail_list
);

6
mod/regmod.php
View file

@ -19,7 +19,7 @@ function user_allow($hash)
$a = get_app();
$register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1",
dbesc($hash)
DBA::escape($hash)
);
@ -36,7 +36,7 @@ function user_allow($hash)
}
$r = q("DELETE FROM `register` WHERE `hash` = '%s'",
dbesc($register[0]['hash'])
DBA::escape($register[0]['hash'])
);
@ -77,7 +77,7 @@ function user_allow($hash)
function user_deny($hash)
{
$register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1",
dbesc($hash)
DBA::escape($hash)
);
if (!DBA::isResult($register)) {

4
mod/repair_ostatus.php
View file

@ -26,7 +26,7 @@ function repair_ostatus_content(App $a) {
$r = q("SELECT COUNT(*) AS `total` FROM `contact` WHERE
`uid` = %d AND `network` = '%s' AND `rel` IN (%d, %d)",
intval($uid),
dbesc(NETWORK_OSTATUS),
DBA::escape(NETWORK_OSTATUS),
intval(CONTACT_IS_FRIEND),
intval(CONTACT_IS_SHARING));
@ -40,7 +40,7 @@ function repair_ostatus_content(App $a) {
ORDER BY `url`
LIMIT %d, 1",
intval($uid),
dbesc(NETWORK_OSTATUS),
DBA::escape(NETWORK_OSTATUS),
intval(CONTACT_IS_FRIEND),
intval(CONTACT_IS_SHARING), $counter++);

18
mod/salmon.php
View file

@ -25,7 +25,7 @@ function salmon_post(App $a, $xml = '') {
$mentions = (($a->argc > 2 && $a->argv[2] === 'mention') ? true : false);
$r = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `account_expired` = 0 AND `account_removed` = 0 LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if (! DBA::isResult($r)) {
System::httpExit(500);
@ -145,11 +145,11 @@ function salmon_post(App $a, $xml = '') {
$r = q("SELECT * FROM `contact` WHERE `network` IN ('%s', '%s')
AND (`nurl` = '%s' OR `alias` = '%s' OR `alias` = '%s')
AND `uid` = %d LIMIT 1",
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_DFRN),
dbesc(normalise_link($author_link)),
dbesc($author_link),
dbesc(normalise_link($author_link)),
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_DFRN),
DBA::escape(normalise_link($author_link)),
DBA::escape($author_link),
DBA::escape(normalise_link($author_link)),
intval($importer['uid'])
);
if (! DBA::isResult($r)) {
@ -159,9 +159,9 @@ function salmon_post(App $a, $xml = '') {
if($result['success']) {
$r = q("SELECT * FROM `contact` WHERE `network` = '%s' AND ( `url` = '%s' OR `alias` = '%s')
AND `uid` = %d LIMIT 1",
dbesc(NETWORK_OSTATUS),
dbesc($author_link),
dbesc($author_link),
DBA::escape(NETWORK_OSTATUS),
DBA::escape($author_link),
DBA::escape($author_link),
intval($importer['uid'])
);
}

2
mod/search.php
View file

@ -65,7 +65,7 @@ function search_init(App $a) {
if (x($_GET,'save') && $search) {
$r = q("SELECT * FROM `search` WHERE `uid` = %d AND `term` = '%s' LIMIT 1",
intval(local_user()),
dbesc($search)
DBA::escape($search)
);
if (!DBA::isResult($r)) {
DBA::insert('search', ['uid' => local_user(), 'term' => $search]);

60
mod/settings.php
View file

@ -175,23 +175,23 @@ function settings_post(App $a)
icon='%s',
uid=%d
WHERE client_id='%s'",
dbesc($key),
dbesc($secret),
dbesc($name),
dbesc($redirect),
dbesc($icon),
DBA::escape($key),
DBA::escape($secret),
DBA::escape($name),
DBA::escape($redirect),
DBA::escape($icon),
local_user(),
dbesc($key)
DBA::escape($key)
);
} else {
q("INSERT INTO clients
(client_id, pw, name, redirect_uri, icon, uid)
VALUES ('%s', '%s', '%s', '%s', '%s',%d)",
dbesc($key),
dbesc($secret),
dbesc($name),
dbesc($redirect),
dbesc($icon),
DBA::escape($key),
DBA::escape($secret),
DBA::escape($name),
DBA::escape($redirect),
DBA::escape($icon),
local_user()
);
}
@ -250,13 +250,13 @@ function settings_post(App $a)
$r = q("UPDATE `mailacct` SET `server` = '%s', `port` = %d, `ssltype` = '%s', `user` = '%s',
`action` = %d, `movetofolder` = '%s',
`mailbox` = 'INBOX', `reply_to` = '%s', `pubmail` = %d WHERE `uid` = %d",
dbesc($mail_server),
DBA::escape($mail_server),
intval($mail_port),
dbesc($mail_ssl),
dbesc($mail_user),
DBA::escape($mail_ssl),
DBA::escape($mail_user),
intval($mail_action),
dbesc($mail_movetofolder),
dbesc($mail_replyto),
DBA::escape($mail_movetofolder),
DBA::escape($mail_replyto),
intval($mail_pubmail),
intval(local_user())
);
@ -356,7 +356,7 @@ function settings_post(App $a)
Theme::install($theme);
$r = q("UPDATE `user` SET `theme` = '%s' WHERE `uid` = %d",
dbesc($theme),
DBA::escape($theme),
intval(local_user())
);
@ -579,29 +579,29 @@ function settings_post(App $a)
`def_gid` = %d, `blockwall` = %d, `hidewall` = %d, `blocktags` = %d,
`unkmail` = %d, `cntunkmail` = %d, `language` = '%s'
WHERE `uid` = %d",
dbesc($username),
dbesc($email),
dbesc($openid),
dbesc($timezone),
dbesc($str_contact_allow),
dbesc($str_group_allow),
dbesc($str_contact_deny),
dbesc($str_group_deny),
DBA::escape($username),
DBA::escape($email),
DBA::escape($openid),
DBA::escape($timezone),
DBA::escape($str_contact_allow),
DBA::escape($str_group_allow),
DBA::escape($str_contact_deny),
DBA::escape($str_group_deny),
intval($notify),
intval($page_flags),
intval($account_type),
dbesc($defloc),
DBA::escape($defloc),
intval($allow_location),
intval($maxreq),
intval($expire),
dbesc($openidserver),
DBA::escape($openidserver),
intval($def_gid),
intval($blockwall),
intval($hidewall),
intval($blocktags),
intval($unkmail),
intval($cntunkmail),
dbesc($language),
DBA::escape($language),
intval(local_user())
);
if (DBA::isResult($r)) {
@ -618,7 +618,7 @@ function settings_post(App $a)
`hide-friends` = %d
WHERE `is-default` = 1 AND `uid` = %d",
intval($publish),
dbesc($username),
DBA::escape($username),
intval($net_publish),
intval($hide_friends),
intval(local_user())
@ -678,7 +678,7 @@ function settings_content(App $a)
if (($a->argc > 3) && ($a->argv[2] === 'edit')) {
$r = q("SELECT * FROM clients WHERE client_id='%s' AND uid=%d",
dbesc($a->argv[3]),
DBA::escape($a->argv[3]),
local_user());
if (!DBA::isResult($r)) {

12
mod/tagger.php
View file

@ -159,7 +159,7 @@ EOT;
$t = q("SELECT count(tid) as tcount FROM term WHERE oid=%d AND term='%s'",
intval($item['id']),
dbesc($term)
DBA::escape($term)
);
if (!$blocktags && $t[0]['tcount'] == 0) {
@ -167,8 +167,8 @@ EOT;
intval($item['id']),
$term_objtype,
TERM_HASHTAG,
dbesc($term),
dbesc(System::baseUrl() . '/search?tag=' . $term),
DBA::escape($term),
DBA::escape(System::baseUrl() . '/search?tag=' . $term),
intval($owner_uid)
);
}
@ -181,7 +181,7 @@ EOT;
);
$t = q("SELECT COUNT(`tid`) AS `tcount` FROM `term` WHERE `oid`=%d AND `term`='%s'",
intval($original_item['id']),
dbesc($term)
DBA::escape($term)
);
if (DBA::isResult($x) && !$x[0]['blocktags'] && $t[0]['tcount'] == 0){
@ -189,8 +189,8 @@ EOT;
intval($original_item['id']),
$term_objtype,
TERM_HASHTAG,
dbesc($term),
dbesc(System::baseUrl() . '/search?tag=' . $term),
DBA::escape($term),
DBA::escape(System::baseUrl() . '/search?tag=' . $term),
intval($owner_uid)
);
}

11
mod/videos.php
View file

@ -8,15 +8,12 @@ use Friendica\Content\Nav;
use Friendica\Core\Config;
use Friendica\Core\L10n;
use Friendica\Core\System;
use Friendica\Core\Worker;
use Friendica\Database\DBA;
use Friendica\Model\Contact;
use Friendica\Model\Group;
use Friendica\Model\Item;
use Friendica\Model\Profile;
use Friendica\Model\Term;
use Friendica\Protocol\DFRN;
use Friendica\Util\DateTimeFormat;
require_once 'include/items.php';
require_once 'include/security.php';
@ -37,7 +34,7 @@ function videos_init(App $a) {
if($a->argc > 1) {
$nick = $a->argv[1];
$user = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `blocked` = 0 LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if(! count($user))
@ -155,16 +152,16 @@ function videos_post(App $a) {
$r = q("SELECT `id` FROM `attach` WHERE `uid` = %d AND `id` = '%s' LIMIT 1",
intval(local_user()),
dbesc($video_id)
DBA::escape($video_id)
);
if (DBA::isResult($r)) {
q("DELETE FROM `attach` WHERE `uid` = %d AND `id` = '%s'",
intval(local_user()),
dbesc($video_id)
DBA::escape($video_id)
);
$i = q("SELECT `id` FROM `item` WHERE `attach` like '%%attach/%s%%' AND `uid` = %d LIMIT 1",
dbesc($video_id),
DBA::escape($video_id),
intval(local_user())
);

14
mod/viewcontacts.php
View file

@ -22,7 +22,7 @@ function viewcontacts_init(App $a)
if ($a->argc > 1) {
$nick = $a->argv[1];
$r = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `blocked` = 0 LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if (! DBA::isResult($r)) {
@ -63,9 +63,9 @@ function viewcontacts_content(App $a)
AND NOT `hidden` AND NOT `archive`
AND `network` IN ('%s', '%s', '%s')",
intval($a->profile['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS)
);
if (DBA::isResult($r)) {
$a->set_pager_total($r[0]['total']);
@ -77,9 +77,9 @@ function viewcontacts_content(App $a)
AND `network` IN ('%s', '%s', '%s')
ORDER BY `name` ASC LIMIT %d, %d",
intval($a->profile['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS),
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS),
intval($a->pager['start']),
intval($a->pager['itemspage'])
);

6
mod/wall_attach.php
View file

@ -18,7 +18,7 @@ function wall_attach_post(App $a) {
if($a->argc > 1) {
$nick = $a->argv[1];
$r = q("SELECT `user`.*, `contact`.`id` FROM `user` LEFT JOIN `contact` on `user`.`uid` = `contact`.`uid` WHERE `user`.`nickname` = '%s' AND `user`.`blocked` = 0 and `contact`.`self` = 1 LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if (! DBA::isResult($r)) {
if ($r_json) {
@ -145,8 +145,8 @@ function wall_attach_post(App $a) {
$r = q("SELECT `id` FROM `attach` WHERE `uid` = %d AND `created` = '%s' AND `hash` = '%s' LIMIT 1",
intval($page_owner_uid),
dbesc($created),
dbesc($hash)
DBA::escape($created),
DBA::escape($hash)
);
if (! DBA::isResult($r)) {

4
mod/wall_upload.php
View file

@ -30,7 +30,7 @@ function wall_upload_post(App $a, $desktopmode = true)
INNER JOIN `contact` on `user`.`uid` = `contact`.`uid`
WHERE `user`.`nickname` = '%s' AND `user`.`blocked` = 0
AND `contact`.`self` = 1 LIMIT 1",
dbesc($nick)
DBA::escape($nick)
);
if (!DBA::isResult($r)) {
@ -46,7 +46,7 @@ function wall_upload_post(App $a, $desktopmode = true)
INNER JOIN `contact` on `user`.`uid` = `contact`.`uid`
WHERE `user`.`nickname` = '%s' AND `user`.`blocked` = 0
AND `contact`.`self` = 1 LIMIT 1",
dbesc($user_info['screen_name'])
DBA::escape($user_info['screen_name'])
);
}
} else {

4
mod/wallmessage.php
View file

@ -26,7 +26,7 @@ function wallmessage_post(App $a) {
}
$r = q("select * from user where nickname = '%s' limit 1",
dbesc($recipient)
DBA::escape($recipient)
);
if (! DBA::isResult($r)) {
@ -88,7 +88,7 @@ function wallmessage_content(App $a) {
}
$r = q("select * from user where nickname = '%s' limit 1",
dbesc($recipient)
DBA::escape($recipient)
);
if (! DBA::isResult($r)) {

2
src/Core/ACL.php
View file

@ -85,7 +85,7 @@ class ACL extends BaseObject
if (!empty($x['networks'])) {
/// @TODO rewrite to foreach()
array_walk($x['networks'], function (&$value) {
$value = "'" . dbesc($value) . "'";
$value = "'" . DBA::escape($value) . "'";
});
$str_nets = implode(',', $x['networks']);
$sql_extra .= " AND `network` IN ( $str_nets ) ";

6
src/Core/NotificationsManager.php
View file

@ -66,7 +66,7 @@ class NotificationsManager extends BaseObject
$filter_str = [];
$filter_sql = "";
foreach ($filter as $column => $value) {
$filter_str[] = sprintf("`%s` = '%s'", $column, dbesc($value));
$filter_str[] = sprintf("`%s` = '%s'", $column, DBA::escape($value));
}
if (count($filter_str) > 0) {
$filter_sql = "AND " . implode(" AND ", $filter_str);
@ -134,9 +134,9 @@ class NotificationsManager extends BaseObject
return q(
"UPDATE `notify` SET `seen` = %d WHERE (`link` = '%s' OR (`parent` != 0 AND `parent` = %d AND `otype` = '%s')) AND `uid` = %d",
intval($seen),
dbesc($note['link']),
DBA::escape($note['link']),
intval($note['parent']),
dbesc($note['otype']),
DBA::escape($note['otype']),
intval(local_user())
);
}

6
src/Core/UserImport.php
View file

@ -35,7 +35,7 @@ class UserImport
*/
private static function checkCols($table, &$arr)
{
$query = sprintf("SHOW COLUMNS IN `%s`", dbesc($table));
$query = sprintf("SHOW COLUMNS IN `%s`", DBA::escape($table));
logger("uimport: $query", LOGGER_DEBUG);
$r = q($query);
$tcols = [];
@ -64,8 +64,8 @@ class UserImport
}
self::checkCols($table, $arr);
$cols = implode("`,`", array_map('dbesc', array_keys($arr)));
$vals = implode("','", array_map('dbesc', array_values($arr)));
$cols = implode("`,`", array_map(['Friendica\Database\DBA', 'escape'], array_keys($arr)));
$vals = implode("','", array_map(['Friendica\Database\DBA', 'escape'], array_values($arr)));
$query = "INSERT INTO `$table` (`$cols`) VALUES ('$vals')";
logger("uimport: $query", LOGGER_TRACE);

8
src/Database/DBA.php
View file

@ -251,12 +251,16 @@ class DBA
}
public static function escape($str) {
if (self::$connected) {
switch (self::$driver) {
case 'pdo':
return substr(@self::$connection->quote($str, PDO::PARAM_STR), 1, -1);
case 'mysqli':
return @self::$connection->real_escape_string($str);
}
} else {
return str_replace("'", "\\'", $str);
}
}
public static function connected() {
@ -1610,7 +1614,7 @@ class DBA
if (is_bool($value)) {
$value = ($value ? '1' : '0');
} else {
$value = dbesc($value);
$value = self::escape($value);
}
return;
}
@ -1620,7 +1624,7 @@ class DBA
} elseif (is_float($value) || is_integer($value)) {
$value = (string) $value;
} else {
$value = "'" . dbesc($value) . "'";
$value = "'" . self::escape($value) . "'";
}
}

34
src/Database/DBStructure.php
View file

@ -27,7 +27,7 @@ class DBStructure
*/
public static function convertToInnoDB() {
$r = q("SELECT `TABLE_NAME` FROM `information_schema`.`tables` WHERE `engine` = 'MyISAM' AND `table_schema` = '%s'",
dbesc(DBA::databaseName()));
DBA::escape(DBA::databaseName()));
if (!DBA::isResult($r)) {
echo L10n::t('There are no tables on MyISAM.')."\n";
@ -35,7 +35,7 @@ class DBStructure
}
foreach ($r AS $table) {
$sql = sprintf("ALTER TABLE `%s` engine=InnoDB;", dbesc($table['TABLE_NAME']));
$sql = sprintf("ALTER TABLE `%s` engine=InnoDB;", DBA::escape($table['TABLE_NAME']));
echo $sql."\n";
$result = DBA::e($sql);
@ -55,7 +55,7 @@ class DBStructure
$a = get_app();
//send the administrators an e-mail
$admin_mail_list = "'".implode("','", array_map('dbesc', explode(",", str_replace(" ", "", Config::get('config', 'admin_email')))))."'";
$admin_mail_list = "'".implode("','", array_map(['Friendica\Database\DBA', 'escape'], explode(",", str_replace(" ", "", Config::get('config', 'admin_email')))))."'";
$adminlist = q("SELECT uid, language, email FROM user WHERE email IN (%s)",
$admin_mail_list
);
@ -369,7 +369,7 @@ class DBStructure
if (isset($database[$name]["table_status"]["Comment"])) {
if ($database[$name]["table_status"]["Comment"] != $structure['comment']) {
$sql2 = "COMMENT = '".dbesc($structure['comment'])."'";
$sql2 = "COMMENT = '".DBA::escape($structure['comment'])."'";
if ($sql3 == "") {
$sql3 = "ALTER" . $ignore . " TABLE `".$temp_name."` ".$sql2;
@ -381,7 +381,7 @@ class DBStructure
if (isset($database[$name]["table_status"]["Engine"]) && isset($structure['engine'])) {
if ($database[$name]["table_status"]["Engine"] != $structure['engine']) {
$sql2 = "ENGINE = '".dbesc($structure['engine'])."'";
$sql2 = "ENGINE = '".DBA::escape($structure['engine'])."'";
if ($sql3 == "") {
$sql3 = "ALTER" . $ignore . " TABLE `".$temp_name."` ".$sql2;
@ -558,7 +558,7 @@ class DBStructure
}
if (isset($parameters["comment"])) {
$fieldstruct .= " COMMENT '".dbesc($parameters["comment"])."'";
$fieldstruct .= " COMMENT '".DBA::escape($parameters["comment"])."'";
}
/*if (($parameters["primary"] != "") && $create)
@ -575,7 +575,7 @@ class DBStructure
$sql_rows = [];
$primary_keys = [];
foreach ($structure["fields"] AS $fieldname => $field) {
$sql_rows[] = "`".dbesc($fieldname)."` ".self::FieldCommand($field);
$sql_rows[] = "`".DBA::escape($fieldname)."` ".self::FieldCommand($field);
if (x($field,'primary') && $field['primary']!='') {
$primary_keys[] = $fieldname;
}
@ -595,12 +595,12 @@ class DBStructure
}
if (isset($structure["comment"])) {
$comment = " COMMENT='" . dbesc($structure["comment"]) . "'";
$comment = " COMMENT='" . DBA::escape($structure["comment"]) . "'";
}
$sql = implode(",\n\t", $sql_rows);
$sql = sprintf("CREATE TABLE IF NOT EXISTS `%s` (\n\t", dbesc($name)).$sql.
$sql = sprintf("CREATE TABLE IF NOT EXISTS `%s` (\n\t", DBA::escape($name)).$sql.
"\n)" . $engine . " DEFAULT COLLATE utf8mb4_general_ci" . $comment;
if ($verbose) {
echo $sql.";\n";
@ -614,17 +614,17 @@ class DBStructure
}
private static function addTableField($fieldname, $parameters) {
$sql = sprintf("ADD `%s` %s", dbesc($fieldname), self::FieldCommand($parameters));
$sql = sprintf("ADD `%s` %s", DBA::escape($fieldname), self::FieldCommand($parameters));
return($sql);
}
private static function modifyTableField($fieldname, $parameters) {
$sql = sprintf("MODIFY `%s` %s", dbesc($fieldname), self::FieldCommand($parameters, false));
$sql = sprintf("MODIFY `%s` %s", DBA::escape($fieldname), self::FieldCommand($parameters, false));
return($sql);
}
private static function dropIndex($indexname) {
$sql = sprintf("DROP INDEX `%s`", dbesc($indexname));
$sql = sprintf("DROP INDEX `%s`", DBA::escape($indexname));
return($sql);
}
@ -646,9 +646,9 @@ class DBStructure
}
if (preg_match('|(.+)\((\d+)\)|', $fieldname, $matches)) {
$names .= "`".dbesc($matches[1])."`(".intval($matches[2]).")";
$names .= "`".DBA::escape($matches[1])."`(".intval($matches[2]).")";
} else {
$names .= "`".dbesc($fieldname)."`";
$names .= "`".DBA::escape($fieldname)."`";
}
}
@ -657,7 +657,7 @@ class DBStructure
}
$sql = sprintf("%s INDEX `%s` (%s)", $method, dbesc($indexname), $names);
$sql = sprintf("%s INDEX `%s` (%s)", $method, DBA::escape($indexname), $names);
return($sql);
}
@ -675,9 +675,9 @@ class DBStructure
}
if (preg_match('|(.+)\((\d+)\)|', $fieldname, $matches)) {
$names .= "`".dbesc($matches[1])."`";
$names .= "`".DBA::escape($matches[1])."`";
} else {
$names .= "`".dbesc($fieldname)."`";
$names .= "`".DBA::escape($fieldname)."`";
}
}

6
src/Database/PostUpdate.php
View file

@ -76,7 +76,7 @@ class PostUpdate
$r = q($query1.$query2.$query3." ORDER BY `item`.`id` LIMIT 1",
intval($start_id), intval($end_id),
dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS));
DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA), DBA::escape(NETWORK_OSTATUS));
if (!$r) {
Config::set("system", "post_update_version", 1194);
logger("Update is done", LOGGER_DEBUG);
@ -90,7 +90,7 @@ class PostUpdate
$r = q($query1.$query2.$query3." ORDER BY `item`.`id` LIMIT 1000,1",
intval($start_id), intval($end_id),
dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS));
DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA), DBA::escape(NETWORK_OSTATUS));
if ($r) {
$pos_id = $r[0]["id"];
} else {
@ -100,7 +100,7 @@ class PostUpdate
q("UPDATE `item` ".$query2." SET `item`.`global` = 1 ".$query3,
intval($start_id), intval($pos_id),
dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS));
DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA), DBA::escape(NETWORK_OSTATUS));
logger("Done", LOGGER_DEBUG);
}

46
src/Model/Contact.php
View file

@ -536,7 +536,7 @@ class Contact extends BaseObject
$r = q("SELECT `id`, `id` AS `cid`, 0 AS `gid`, 0 AS `zid`, `uid`, `url`, `nurl`, `alias`, `network`, `name`, `nick`, `addr`, `location`, `about`, `xmpp`,
`keywords`, `gender`, `photo`, `thumb`, `micro`, `forum`, `prv`, (`forum` | `prv`) AS `community`, `contact-type`, `bd` AS `birthday`, `self`
FROM `contact` WHERE `addr` = '%s' AND `uid` = %d",
dbesc($addr),
DBA::escape($addr),
intval($uid)
);
// Fetch the data from the contact table with "uid=0" (which is filled automatically)
@ -544,7 +544,7 @@ class Contact extends BaseObject
$r = q("SELECT `id`, 0 AS `cid`, `id` AS `zid`, 0 AS `gid`, `uid`, `url`, `nurl`, `alias`, `network`, `name`, `nick`, `addr`, `location`, `about`, `xmpp`,
`keywords`, `gender`, `photo`, `thumb`, `micro`, `forum`, `prv`, (`forum` | `prv`) AS `community`, `contact-type`, `bd` AS `birthday`, 0 AS `self`
FROM `contact` WHERE `addr` = '%s' AND `uid` = 0",
dbesc($addr)
DBA::escape($addr)
);
}
@ -553,7 +553,7 @@ class Contact extends BaseObject
$r = q("SELECT 0 AS `id`, 0 AS `cid`, `id` AS `gid`, 0 AS `zid`, 0 AS `uid`, `url`, `nurl`, `alias`, `network`, `name`, `nick`, `addr`, `location`, `about`, '' AS `xmpp`,
`keywords`, `gender`, `photo`, `photo` AS `thumb`, `photo` AS `micro`, `community` AS `forum`, 0 AS `prv`, `community`, `contact-type`, `birthday`, 0 AS `self`
FROM `gcontact` WHERE `addr` = '%s'",
dbesc($addr)
DBA::escape($addr)
);
}
@ -1014,7 +1014,7 @@ class Contact extends BaseObject
// This speeds up the query a lot
$r = q("SELECT `network`, `id` AS `author-id`, `contact-type` FROM `contact`
WHERE `contact`.`nurl` = '%s' AND `contact`.`uid` = 0",
dbesc(normalise_link($contact_url))
DBA::escape(normalise_link($contact_url))
);
if (!DBA::isResult($r)) {
@ -1297,16 +1297,16 @@ class Contact extends BaseObject
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `poll` IN ('%s', '%s') AND `network` = '%s' AND NOT `pending` LIMIT 1",
intval($uid),
dbesc($ret['poll']),
dbesc(normalise_link($ret['poll'])),
dbesc($ret['network'])
DBA::escape($ret['poll']),
DBA::escape(normalise_link($ret['poll'])),
DBA::escape($ret['network'])
);
if (!DBA::isResult($r)) {
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND `network` = '%s' AND NOT `pending` LIMIT 1",
intval($uid),
dbesc(normalise_link($url)),
dbesc($ret['network'])
DBA::escape(normalise_link($url)),
DBA::escape($ret['network'])
);
}
@ -1517,13 +1517,13 @@ class Contact extends BaseObject
`blocked`, `readonly`, `pending`, `writable`)
VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, 0, 0, 1, 1)",
intval($importer['uid']),
dbesc(DateTimeFormat::utcNow()),
dbesc($url),
dbesc(normalise_link($url)),
dbesc($name),
dbesc($nick),
dbesc($photo),
dbesc(NETWORK_OSTATUS),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape($url),
DBA::escape(normalise_link($url)),
DBA::escape($name),
DBA::escape($nick),
DBA::escape($photo),
DBA::escape(NETWORK_OSTATUS),
intval(CONTACT_IS_FOLLOWER)
);
@ -1574,7 +1574,7 @@ class Contact extends BaseObject
} elseif (DBA::isResult($user) && in_array($user['page-flags'], [PAGE_SOAPBOX, PAGE_FREELOVE, PAGE_COMMUNITY])) {
q("UPDATE `contact` SET `pending` = 0 WHERE `uid` = %d AND `url` = '%s' AND `pending` LIMIT 1",
intval($importer['uid']),
dbesc($url)
DBA::escape($url)
);
}
}
@ -1625,7 +1625,7 @@ class Contact extends BaseObject
// Check for duplicates
$s = q("SELECT `id` FROM `event` WHERE `uid` = %d AND `cid` = %d AND `start` = '%s' AND `type` = '%s' LIMIT 1",
intval($rr['uid']), intval($rr['id']), dbesc(DateTimeFormat::utc($nextbd)), dbesc('birthday'));
intval($rr['uid']), intval($rr['id']), DBA::escape(DateTimeFormat::utc($nextbd)), DBA::escape('birthday'));
if (DBA::isResult($s)) {
continue;
@ -1636,15 +1636,15 @@ class Contact extends BaseObject
q("INSERT INTO `event` (`uid`,`cid`,`created`,`edited`,`start`,`finish`,`summary`,`desc`,`type`,`adjust`)
VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%d' ) ", intval($rr['uid']), intval($rr['id']),
dbesc(DateTimeFormat::utcNow()), dbesc(DateTimeFormat::utcNow()), dbesc(DateTimeFormat::utc($nextbd)),
dbesc(DateTimeFormat::utc($nextbd . ' + 1 day ')), dbesc($bdtext), dbesc($bdtext2), dbesc('birthday'),
DBA::escape(DateTimeFormat::utcNow()), DBA::escape(DateTimeFormat::utcNow()), DBA::escape(DateTimeFormat::utc($nextbd)),
DBA::escape(DateTimeFormat::utc($nextbd . ' + 1 day ')), DBA::escape($bdtext), DBA::escape($bdtext2), DBA::escape('birthday'),
intval(0)
);
// update bdyear
q("UPDATE `contact` SET `bdyear` = '%s', `bd` = '%s' WHERE `uid` = %d AND `id` = %d", dbesc(substr($nextbd, 0, 4)),
dbesc($nextbd), intval($rr['uid']), intval($rr['id'])
q("UPDATE `contact` SET `bdyear` = '%s', `bd` = '%s' WHERE `uid` = %d AND `id` = %d", DBA::escape(substr($nextbd, 0, 4)),
DBA::escape($nextbd), intval($rr['uid']), intval($rr['id'])
);
}
}
@ -1661,7 +1661,7 @@ class Contact extends BaseObject
return;
}
$str = dbesc(implode(',', $contact_ids));
$str = DBA::escape(implode(',', $contact_ids));
$stmt = DBA::p("SELECT `id` FROM `contact` WHERE `id` IN ( " . $str . ") AND `blocked` = 0 AND `pending` = 0 AND `archive` = 0");

12
src/Model/Event.php
View file

@ -510,12 +510,12 @@ class Event extends BaseObject
$sql_extra ",
intval($owner_uid),
intval($event_params["ignore"]),
dbesc($event_params["start"]),
dbesc($event_params["start"]),
dbesc($event_params["finish"]),
dbesc($event_params["adjust_start"]),
dbesc($event_params["adjust_start"]),
dbesc($event_params["adjust_finish"])
DBA::escape($event_params["start"]),
DBA::escape($event_params["start"]),
DBA::escape($event_params["finish"]),
DBA::escape($event_params["adjust_start"]),
DBA::escape($event_params["adjust_start"]),
DBA::escape($event_params["adjust_finish"])
);
if (DBA::isResult($r)) {

58
src/Model/GContact.php
View file

@ -112,12 +112,12 @@ class GContact
intval($uid),
intval($gcid),
intval($zcid),
dbesc(DateTimeFormat::utcNow())
DBA::escape(DateTimeFormat::utcNow())
);
} else {
q(
"UPDATE `glink` SET `updated` = '%s' WHERE `cid` = %d AND `uid` = %d AND `gcid` = %d AND `zcid` = %d",
dbesc(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
intval($cid),
intval($uid),
intval($gcid),
@ -176,8 +176,8 @@ class GContact
if (!isset($gcontact['network'])) {
$r = q(
"SELECT `network` FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' AND `network` != '' AND `network` != '%s' LIMIT 1",
dbesc(normalise_link($gcontact['url'])),
dbesc(NETWORK_STATUSNET)
DBA::escape(normalise_link($gcontact['url'])),
DBA::escape(NETWORK_STATUSNET)
);
if (DBA::isResult($r)) {
$gcontact['network'] = $r[0]["network"];
@ -186,9 +186,9 @@ class GContact
if (($gcontact['network'] == "") || ($gcontact['network'] == NETWORK_OSTATUS)) {
$r = q(
"SELECT `network`, `url` FROM `contact` WHERE `uid` = 0 AND `alias` IN ('%s', '%s') AND `network` != '' AND `network` != '%s' LIMIT 1",
dbesc($gcontact['url']),
dbesc(normalise_link($gcontact['url'])),
dbesc(NETWORK_STATUSNET)
DBA::escape($gcontact['url']),
DBA::escape(normalise_link($gcontact['url'])),
DBA::escape(NETWORK_STATUSNET)
);
if (DBA::isResult($r)) {
$gcontact['network'] = $r[0]["network"];
@ -201,7 +201,7 @@ class GContact
$x = q(
"SELECT * FROM `gcontact` WHERE `nurl` = '%s' LIMIT 1",
dbesc(normalise_link($gcontact['url']))
DBA::escape(normalise_link($gcontact['url']))
);
if (DBA::isResult($x)) {
@ -489,7 +489,7 @@ class GContact
intval($uid),
intval($uid),
intval($uid),
dbesc(NULL_DATE),
DBA::escape(NULL_DATE),
$sql_network,
intval($start),
intval($limit)
@ -518,7 +518,7 @@ class GContact
intval($uid),
intval($uid),
intval($uid),
dbesc(NULL_DATE),
DBA::escape(NULL_DATE),
$sql_network,
intval($start),
intval($limit)
@ -580,8 +580,8 @@ class GContact
// Query your contacts from Friendica and Redmatrix/Hubzilla for their contacts
$r = q(
"SELECT DISTINCT(`poco`) AS `poco` FROM `contact` WHERE `network` IN ('%s', '%s')",
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA)
);
if (DBA::isResult($r)) {
@ -690,7 +690,7 @@ class GContact
DBA::lock('gcontact');
$r = q(
"SELECT `id`, `last_contact`, `last_failure`, `network` FROM `gcontact` WHERE `nurl` = '%s' LIMIT 1",
dbesc(normalise_link($contact["url"]))
DBA::escape(normalise_link($contact["url"]))
);
if (DBA::isResult($r)) {
@ -708,24 +708,24 @@ class GContact
q(
"INSERT INTO `gcontact` (`name`, `nick`, `addr` , `network`, `url`, `nurl`, `photo`, `created`, `updated`, `location`, `about`, `hide`, `generation`)
VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d)",
dbesc($contact["name"]),
dbesc($contact["nick"]),
dbesc($contact["addr"]),
dbesc($contact["network"]),
dbesc($contact["url"]),
dbesc(normalise_link($contact["url"])),
dbesc($contact["photo"]),
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utcNow()),
dbesc($contact["location"]),
dbesc($contact["about"]),
DBA::escape($contact["name"]),
DBA::escape($contact["nick"]),
DBA::escape($contact["addr"]),
DBA::escape($contact["network"]),
DBA::escape($contact["url"]),
DBA::escape(normalise_link($contact["url"])),
DBA::escape($contact["photo"]),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape($contact["location"]),
DBA::escape($contact["about"]),
intval($contact["hide"]),
intval($contact["generation"])
);
$r = q(
"SELECT `id`, `network` FROM `gcontact` WHERE `nurl` = '%s' ORDER BY `id` LIMIT 2",
dbesc(normalise_link($contact["url"]))
DBA::escape(normalise_link($contact["url"]))
);
if (DBA::isResult($r)) {
@ -1048,8 +1048,8 @@ class GContact
$r = q(
"SELECT `nurl`, `url` FROM `gserver` WHERE `last_contact` >= `last_failure` AND `network` = '%s' AND `last_poco_query` < '%s' ORDER BY RAND() LIMIT 5",
dbesc(NETWORK_OSTATUS),
dbesc($last_update)
DBA::escape(NETWORK_OSTATUS),
DBA::escape($last_update)
);
if (!DBA::isResult($r)) {
@ -1058,7 +1058,7 @@ class GContact
foreach ($r as $server) {
self::fetchGsUsers($server["url"]);
q("UPDATE `gserver` SET `last_poco_query` = '%s' WHERE `nurl` = '%s'", dbesc(DateTimeFormat::utcNow()), dbesc($server["nurl"]));
q("UPDATE `gserver` SET `last_poco_query` = '%s' WHERE `nurl` = '%s'", DBA::escape(DateTimeFormat::utcNow()), DBA::escape($server["nurl"]));
}
}
@ -1072,7 +1072,7 @@ class GContact
AND `last_contact` >= `last_failure`
AND `updated` > UTC_TIMESTAMP - INTERVAL 1 MONTH
ORDER BY rand() LIMIT 1",
dbesc(NETWORK_DFRN)
DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {

4
src/Model/Mail.php
View file

@ -58,8 +58,8 @@ class Mail
$reply = true;
$r = q("SELECT `convid` FROM `mail` WHERE `uid` = %d AND (`uri` = '%s' OR `parent-uri` = '%s') LIMIT 1",
intval(local_user()),
dbesc($replyto),
dbesc($replyto)
DBA::escape($replyto),
DBA::escape($replyto)
);
if (DBA::isResult($r)) {
$convid = $r[0]['convid'];

8
src/Model/Photo.php
View file

@ -239,8 +239,8 @@ class Photo
WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s' $sql_extra
GROUP BY `album` ORDER BY `created` DESC",
intval($uid),
dbesc('Contact Photos'),
dbesc(L10n::t('Contact Photos'))
DBA::escape('Contact Photos'),
DBA::escape(L10n::t('Contact Photos'))
);
} else {
// This query doesn't do the count and is much faster
@ -248,8 +248,8 @@ class Photo
FROM `photo` USE INDEX (`uid_album_scale_created`)
WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s' $sql_extra",
intval($uid),
dbesc('Contact Photos'),
dbesc(L10n::t('Contact Photos'))
DBA::escape('Contact Photos'),
DBA::escape(L10n::t('Contact Photos'))
);
}
Cache::set($key, $albums, CACHE_DAY);

8
src/Model/Profile.php
View file

@ -346,7 +346,7 @@ class Profile
$r = q(
"SELECT `url` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND `rel` = %d",
intval($profile['uid']),
dbesc(normalise_link(self::getMyURL())),
DBA::escape(normalise_link(self::getMyURL())),
intval(CONTACT_IS_FRIEND)
);
}
@ -463,9 +463,9 @@ class Profile
AND NOT `hidden` AND NOT `archive`
AND `network` IN ('%s', '%s', '%s', '')",
intval($profile['uid']),
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS)
);
if (DBA::isResult($r)) {
$contacts = intval($r[0]['total']);

100
src/Protocol/DFRN.php
View file

@ -129,7 +129,7 @@ class DFRN
"SELECT `contact`.*, `user`.`nickname`, `user`.`timezone`, `user`.`page-flags`, `user`.`account-type`
FROM `contact` INNER JOIN `user` ON `user`.`uid` = `contact`.`uid`
WHERE `contact`.`self` AND `user`.`nickname` = '%s' LIMIT 1",
dbesc($owner_nick)
DBA::escape($owner_nick)
);
if (! DBA::isResult($r)) {
@ -147,15 +147,15 @@ class DFRN
$sql_extra = '';
switch ($direction) {
case (-1):
$sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
$sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
@ -196,8 +196,8 @@ class DFRN
",
intval($contact['id']),
intval($contact['id']),
dbesc($gs),
dbesc($gs)
DBA::escape($gs),
DBA::escape($gs)
);
}
@ -214,7 +214,7 @@ class DFRN
if (isset($category)) {
$sql_post_table = sprintf(
"INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ",
dbesc(protect_sprintf($category)),
DBA::escape(protect_sprintf($category)),
intval(TERM_OBJ_POST),
intval(TERM_CATEGORY),
intval($owner_id)
@ -236,8 +236,8 @@ class DFRN
$sql_extra
ORDER BY `item`.`parent` ".$sort.", `item`.`created` ASC LIMIT 0, 300",
intval($owner_id),
dbesc($check_date),
dbesc($sort)
DBA::escape($check_date),
DBA::escape($sort)
);
$ids = [];
@ -1073,7 +1073,7 @@ class DFRN
$r = q(
"SELECT `forum`, `prv` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s'",
intval($owner["uid"]),
dbesc(normalise_link($mention))
DBA::escape(normalise_link($mention))
);
if (DBA::isResult($r) && ($r[0]["forum"] || $r[0]["prv"])) {
@ -1498,8 +1498,8 @@ class DFRN
"SELECT `id` FROM `event` WHERE `uid` = %d AND `cid` = %d AND `start` = '%s' AND `type` = '%s' LIMIT 1",
intval($contact['uid']),
intval($contact['id']),
dbesc(DateTimeFormat::utc($birthday)),
dbesc('birthday')
DBA::escape(DateTimeFormat::utc($birthday)),
DBA::escape('birthday')
);
if (DBA::isResult($r)) {
@ -1516,13 +1516,13 @@ class DFRN
VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s') ",
intval($contact['uid']),
intval($contact['id']),
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utc($birthday)),
dbesc(DateTimeFormat::utc($birthday . ' + 1 day ')),
dbesc($bdtext),
dbesc($bdtext2),
dbesc('birthday')
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utc($birthday)),
DBA::escape(DateTimeFormat::utc($birthday . ' + 1 day ')),
DBA::escape($bdtext),
DBA::escape($bdtext2),
DBA::escape('birthday')
);
}
@ -1744,11 +1744,11 @@ class DFRN
`addr` = '%s', `keywords` = '%s', `bdyear` = '%s', `bd` = '%s', `hidden` = %d,
`xmpp` = '%s', `name-date` = '%s', `uri-date` = '%s'
WHERE `id` = %d AND `network` = '%s'",
dbesc($contact["name"]), dbesc($contact["nick"]), dbesc($contact["about"]), dbesc($contact["location"]),
dbesc($contact["addr"]), dbesc($contact["keywords"]), dbesc($contact["bdyear"]),
dbesc($contact["bd"]), intval($contact["hidden"]), dbesc($contact["xmpp"]),
dbesc(DateTimeFormat::utc($contact["name-date"])), dbesc(DateTimeFormat::utc($contact["uri-date"])),
intval($contact["id"]), dbesc($contact["network"])
DBA::escape($contact["name"]), DBA::escape($contact["nick"]), DBA::escape($contact["about"]), DBA::escape($contact["location"]),
DBA::escape($contact["addr"]), DBA::escape($contact["keywords"]), DBA::escape($contact["bdyear"]),
DBA::escape($contact["bd"]), intval($contact["hidden"]), DBA::escape($contact["xmpp"]),
DBA::escape(DateTimeFormat::utc($contact["name-date"])), DBA::escape(DateTimeFormat::utc($contact["uri-date"])),
intval($contact["id"]), DBA::escape($contact["network"])
);
}
@ -1914,8 +1914,8 @@ class DFRN
$r = q(
"SELECT `id` FROM `contact` WHERE `name` = '%s' AND `nurl` = '%s' AND `uid` = %d LIMIT 1",
dbesc($suggest["name"]),
dbesc(normalise_link($suggest["url"])),
DBA::escape($suggest["name"]),
DBA::escape(normalise_link($suggest["url"])),
intval($suggest["uid"])
);
@ -1935,9 +1935,9 @@ class DFRN
$fid = 0;
$r = q(
"SELECT `id` FROM `fcontact` WHERE `url` = '%s' AND `name` = '%s' AND `request` = '%s' LIMIT 1",
dbesc($suggest["url"]),
dbesc($suggest["name"]),
dbesc($suggest["request"])
DBA::escape($suggest["url"]),
DBA::escape($suggest["name"]),
DBA::escape($suggest["request"])
);
if (DBA::isResult($r)) {
$fid = $r[0]["id"];
@ -1963,17 +1963,17 @@ class DFRN
if (!$fid) {
$r = q(
"INSERT INTO `fcontact` (`name`,`url`,`photo`,`request`) VALUES ('%s', '%s', '%s', '%s')",
dbesc($suggest["name"]),
dbesc($suggest["url"]),
dbesc($suggest["photo"]),
dbesc($suggest["request"])
DBA::escape($suggest["name"]),
DBA::escape($suggest["url"]),
DBA::escape($suggest["photo"]),
DBA::escape($suggest["request"])
);
}
$r = q(
"SELECT `id` FROM `fcontact` WHERE `url` = '%s' AND `name` = '%s' AND `request` = '%s' LIMIT 1",
dbesc($suggest["url"]),
dbesc($suggest["name"]),
dbesc($suggest["request"])
DBA::escape($suggest["url"]),
DBA::escape($suggest["name"]),
DBA::escape($suggest["request"])
);
/*
@ -1995,9 +1995,9 @@ class DFRN
intval($suggest["uid"]),
intval($fid),
intval($suggest["cid"]),
dbesc($suggest["body"]),
dbesc($hash),
dbesc(DateTimeFormat::utcNow()),
DBA::escape($suggest["body"]),
DBA::escape($hash),
DBA::escape(DateTimeFormat::utcNow()),
intval(0)
);
@ -2172,9 +2172,9 @@ class DFRN
AND `item`.`uid` = %d
$sql_extra
LIMIT 1",
dbesc($parent["parent-uri"]),
dbesc($parent["parent-uri"]),
dbesc($parent["parent-uri"]),
DBA::escape($parent["parent-uri"]),
DBA::escape($parent["parent-uri"]),
DBA::escape($parent["parent-uri"]),
intval($importer["importer_uid"])
);
if (DBA::isResult($r)) {
@ -2645,7 +2645,7 @@ class DFRN
$r = q(
"SELECT `id` FROM `event` WHERE `uri` = '%s' AND `uid` = %d LIMIT 1",
dbesc($item["uri"]),
DBA::escape($item["uri"]),
intval($importer["importer_uid"])
);
if (DBA::isResult($r)) {
@ -2952,10 +2952,10 @@ class DFRN
/// @todo Why is there a query for "url" *and* "nurl"? Especially this normalising is strange.
$r = q("SELECT `id` FROM `contact` WHERE `uid` = (SELECT `uid` FROM `user` WHERE `nickname` = '%s' LIMIT 1)
AND `nick` = '%s' AND NOT `self` AND (`url` LIKE '%%%s%%' OR `nurl` LIKE '%%%s%%') AND NOT `blocked` AND NOT `pending` LIMIT 1",
dbesc($contact_nick),
dbesc($a->user['nickname']),
dbesc($baseurl),
dbesc($nurl)
DBA::escape($contact_nick),
DBA::escape($a->user['nickname']),
DBA::escape($baseurl),
DBA::escape($nurl)
);
if ((! DBA::isResult($r)) || $r[0]['id'] == remote_user()) {
return;
@ -2963,10 +2963,10 @@ class DFRN
$r = q("SELECT * FROM contact WHERE nick = '%s'
AND network = '%s' AND uid = %d AND url LIKE '%%%s%%' LIMIT 1",
dbesc($contact_nick),
dbesc(NETWORK_DFRN),
DBA::escape($contact_nick),
DBA::escape(NETWORK_DFRN),
intval(local_user()),
dbesc($baseurl)
DBA::escape($baseurl)
);
if (! DBA::isResult($r)) {
return;

96
src/Protocol/Diaspora.php
View file

@ -1016,8 +1016,8 @@ class Diaspora
$r = q(
"SELECT `url` FROM `fcontact` WHERE `url` != '' AND `network` = '%s' AND `guid` = '%s'",
dbesc(NETWORK_DIASPORA),
dbesc($fcontact_guid)
DBA::escape(NETWORK_DIASPORA),
DBA::escape($fcontact_guid)
);
if (DBA::isResult($r)) {
@ -1787,7 +1787,7 @@ class Diaspora
$r = q(
"SELECT `id` FROM `mail` WHERE `guid` = '%s' AND `uid` = %d LIMIT 1",
dbesc($msg_guid),
DBA::escape($msg_guid),
intval($importer["uid"])
);
if (DBA::isResult($r)) {
@ -1799,19 +1799,19 @@ class Diaspora
"INSERT INTO `mail` (`uid`, `guid`, `convid`, `from-name`,`from-photo`,`from-url`,`contact-id`,`title`,`body`,`seen`,`reply`,`uri`,`parent-uri`,`created`)
VALUES (%d, '%s', %d, '%s', '%s', '%s', %d, '%s', '%s', %d, %d, '%s','%s','%s')",
intval($importer["uid"]),
dbesc($msg_guid),
DBA::escape($msg_guid),
intval($conversation["id"]),
dbesc($person["name"]),
dbesc($person["photo"]),
dbesc($person["url"]),
DBA::escape($person["name"]),
DBA::escape($person["photo"]),
DBA::escape($person["url"]),
intval($contact["id"]),
dbesc($subject),
dbesc($body),
DBA::escape($subject),
DBA::escape($body),
0,
0,
dbesc($message_uri),
dbesc($author.":".$guid),
dbesc($msg_created_at)
DBA::escape($message_uri),
DBA::escape($author.":".$guid),
DBA::escape($msg_created_at)
);
DBA::unlock();
@ -1870,7 +1870,7 @@ class Diaspora
$c = q(
"SELECT * FROM `conv` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1",
intval($importer["uid"]),
dbesc($guid)
DBA::escape($guid)
);
if ($c)
$conversation = $c[0];
@ -1879,18 +1879,18 @@ class Diaspora
"INSERT INTO `conv` (`uid`, `guid`, `creator`, `created`, `updated`, `subject`, `recips`)
VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s')",
intval($importer["uid"]),
dbesc($guid),
dbesc($author),
dbesc($created_at),
dbesc(DateTimeFormat::utcNow()),
dbesc($subject),
dbesc($participants)
DBA::escape($guid),
DBA::escape($author),
DBA::escape($created_at),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape($subject),
DBA::escape($participants)
);
if ($r) {
$c = q(
"SELECT * FROM `conv` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1",
intval($importer["uid"]),
dbesc($guid)
DBA::escape($guid)
);
}
@ -2049,7 +2049,7 @@ class Diaspora
$c = q(
"SELECT * FROM `conv` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1",
intval($importer["uid"]),
dbesc($conversation_guid)
DBA::escape($conversation_guid)
);
if ($c) {
$conversation = $c[0];
@ -2074,7 +2074,7 @@ class Diaspora
$r = q(
"SELECT `id` FROM `mail` WHERE `guid` = '%s' AND `uid` = %d LIMIT 1",
dbesc($guid),
DBA::escape($guid),
intval($importer["uid"])
);
if (DBA::isResult($r)) {
@ -2086,19 +2086,19 @@ class Diaspora
"INSERT INTO `mail` (`uid`, `guid`, `convid`, `from-name`,`from-photo`,`from-url`,`contact-id`,`title`,`body`,`seen`,`reply`,`uri`,`parent-uri`,`created`)
VALUES ( %d, '%s', %d, '%s', '%s', '%s', %d, '%s', '%s', %d, %d, '%s','%s','%s')",
intval($importer["uid"]),
dbesc($guid),
DBA::escape($guid),
intval($conversation["id"]),
dbesc($person["name"]),
dbesc($person["photo"]),
dbesc($person["url"]),
DBA::escape($person["name"]),
DBA::escape($person["photo"]),
DBA::escape($person["url"]),
intval($contact["id"]),
dbesc($conversation["subject"]),
dbesc($body),
DBA::escape($conversation["subject"]),
DBA::escape($body),
0,
1,
dbesc($message_uri),
dbesc($author.":".$conversation["guid"]),
dbesc($created_at)
DBA::escape($message_uri),
DBA::escape($author.":".$conversation["guid"]),
DBA::escape($created_at)
);
DBA::unlock();
@ -2401,18 +2401,18 @@ class Diaspora
"INSERT INTO `contact` (`uid`, `network`,`addr`,`created`,`url`,`nurl`,`batch`,`name`,`nick`,`photo`,`pubkey`,`notify`,`poll`,`blocked`,`priority`)
VALUES (%d, '%s', '%s', '%s', '%s','%s','%s','%s','%s','%s','%s','%s','%s',%d,%d)",
intval($importer["uid"]),
dbesc($ret["network"]),
dbesc($ret["addr"]),
DBA::escape($ret["network"]),
DBA::escape($ret["addr"]),
DateTimeFormat::utcNow(),
dbesc($ret["url"]),
dbesc(normalise_link($ret["url"])),
dbesc($batch),
dbesc($ret["name"]),
dbesc($ret["nick"]),
dbesc($ret["photo"]),
dbesc($ret["pubkey"]),
dbesc($ret["notify"]),
dbesc($ret["poll"]),
DBA::escape($ret["url"]),
DBA::escape(normalise_link($ret["url"])),
DBA::escape($batch),
DBA::escape($ret["name"]),
DBA::escape($ret["nick"]),
DBA::escape($ret["photo"]),
DBA::escape($ret["pubkey"]),
DBA::escape($ret["notify"]),
DBA::escape($ret["poll"]),
1,
2
);
@ -2444,9 +2444,9 @@ class Diaspora
intval($contact_record["id"]),
0,
0,
dbesc(L10n::t("Sharing notification from Diaspora network")),
dbesc($hash),
dbesc(DateTimeFormat::utcNow())
DBA::escape(L10n::t("Sharing notification from Diaspora network")),
DBA::escape($hash),
DBA::escape(DateTimeFormat::utcNow())
);
} else {
// automatic friend approval
@ -2477,8 +2477,8 @@ class Diaspora
WHERE `id` = %d
",
intval($new_relation),
dbesc(DateTimeFormat::utcNow()),
dbesc(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
DBA::escape(DateTimeFormat::utcNow()),
intval($contact_record["id"])
);
@ -4129,7 +4129,7 @@ class Diaspora
$recips = q(
"SELECT `id`,`name`,`network`,`pubkey`,`notify` FROM `contact` WHERE `network` = '%s'
AND `uid` = %d AND `rel` != %d",
dbesc(NETWORK_DIASPORA),
DBA::escape(NETWORK_DIASPORA),
intval($uid),
intval(CONTACT_IS_SHARING)
);

6
src/Protocol/OStatus.php
View file

@ -1573,7 +1573,7 @@ class OStatus
{
$r = q(
"SELECT * FROM `contact` WHERE `nurl` = '%s' AND `uid` IN (0, %d) ORDER BY `uid` DESC LIMIT 1",
dbesc(normalise_link($url)),
DBA::escape(normalise_link($url)),
intval($owner["uid"])
);
if (DBA::isResult($r)) {
@ -1584,7 +1584,7 @@ class OStatus
if (!DBA::isResult($r)) {
$r = q(
"SELECT * FROM `gcontact` WHERE `nurl` = '%s' LIMIT 1",
dbesc(normalise_link($url))
DBA::escape(normalise_link($url))
);
if (DBA::isResult($r)) {
$contact = $r[0];
@ -1790,7 +1790,7 @@ class OStatus
$r = q(
"SELECT `id` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s'",
intval($owner['uid']),
dbesc(normalise_link($contact["url"]))
DBA::escape(normalise_link($contact["url"]))
);
if (DBA::isResult($r)) {

18
src/Protocol/PortableContact.php
View file

@ -281,7 +281,7 @@ class PortableContact
$r = q(
"SELECT `id` FROM `gserver` WHERE `nurl` = '%s' AND `last_contact` > `last_failure`",
dbesc(normalise_link($server_url))
DBA::escape(normalise_link($server_url))
);
if (DBA::isResult($r)) {
@ -306,7 +306,7 @@ class PortableContact
{
$gcontacts = q(
"SELECT * FROM `gcontact` WHERE `nurl` = '%s'",
dbesc(normalise_link($profile))
DBA::escape(normalise_link($profile))
);
if (!DBA::isResult($gcontacts)) {
@ -353,7 +353,7 @@ class PortableContact
if (in_array($gcontacts[0]["network"], ["", NETWORK_FEED])) {
$server = q(
"SELECT `network` FROM `gserver` WHERE `nurl` = '%s' AND `network` != ''",
dbesc(normalise_link($server_url))
DBA::escape(normalise_link($server_url))
);
if ($server) {
@ -366,7 +366,7 @@ class PortableContact
// noscrape is really fast so we don't cache the call.
if (($server_url != "") && ($gcontacts[0]["nick"] != "")) {
// Use noscrape if possible
$server = q("SELECT `noscrape`, `network` FROM `gserver` WHERE `nurl` = '%s' AND `noscrape` != ''", dbesc(normalise_link($server_url)));
$server = q("SELECT `noscrape`, `network` FROM `gserver` WHERE `nurl` = '%s' AND `noscrape` != ''", DBA::escape(normalise_link($server_url)));
if ($server) {
$noscraperet = Network::curl($server[0]["noscrape"]."/".$gcontacts[0]["nick"]);
@ -1477,9 +1477,9 @@ class PortableContact
WHERE `network` IN ('%s', '%s', '%s') AND `last_contact` > `last_failure`
ORDER BY `last_contact`
LIMIT 1000",
dbesc(NETWORK_DFRN),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS)
);
if (!DBA::isResult($r)) {
@ -1509,7 +1509,7 @@ class PortableContact
foreach ($serverlist as $server) {
$server_url = str_replace("/index.php", "", $server->url);
$r = q("SELECT `nurl` FROM `gserver` WHERE `nurl` = '%s'", dbesc(normalise_link($server_url)));
$r = q("SELECT `nurl` FROM `gserver` WHERE `nurl` = '%s'", DBA::escape(normalise_link($server_url)));
if (!DBA::isResult($r)) {
logger("Call server check for server ".$server_url, LOGGER_DEBUG);
Worker::add(PRIORITY_LOW, "DiscoverPoCo", "server", $server_url);
@ -1654,7 +1654,7 @@ class PortableContact
}
$last_update = date("c", time() - (60 * 60 * 24 * $requery_days));
$r = q("SELECT `id`, `url`, `nurl`, `network` FROM `gserver` WHERE `last_contact` >= `last_failure` AND `poco` != '' AND `last_poco_query` < '%s' ORDER BY RAND()", dbesc($last_update));
$r = q("SELECT `id`, `url`, `nurl`, `network` FROM `gserver` WHERE `last_contact` >= `last_failure` AND `poco` != '' AND `last_poco_query` < '%s' ORDER BY RAND()", DBA::escape($last_update));
if (DBA::isResult($r)) {
foreach ($r as $server) {
if (!self::checkServer($server["url"], $server["network"])) {

2
src/Worker/CheckVersion.php
View file

@ -38,7 +38,7 @@ class CheckVersion
logger("Checking VERSION from: ".$checked_url, LOGGER_DEBUG);
// fetch the VERSION file
$gitversion = dbesc(trim(Network::fetchUrl($checked_url)));
$gitversion = DBA::escape(trim(Network::fetchUrl($checked_url)));
logger("Upstream VERSION is: ".$gitversion, LOGGER_DEBUG);
Config::set('system', 'git_friendica_version', $gitversion);

10
src/Worker/Cron.php
View file

@ -187,11 +187,11 @@ class Cron
AND `contact`.`network` IN ('%s', '%s', '%s', '%s', '%s') $sql_extra
AND NOT `contact`.`self` AND NOT `contact`.`blocked`
WHERE NOT `user`.`account_expired` AND NOT `user`.`account_removed` $abandon_sql",
dbesc(NETWORK_DFRN),
dbesc(NETWORK_OSTATUS),
dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_FEED),
dbesc(NETWORK_MAIL)
DBA::escape(NETWORK_DFRN),
DBA::escape(NETWORK_OSTATUS),
DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_FEED),
DBA::escape(NETWORK_MAIL)
);
if (!DBA::isResult($contacts)) {

7
src/Worker/CronJobs.php
View file

@ -9,7 +9,6 @@ use Friendica\BaseObject;
use Friendica\Core\Cache;
use Friendica\Core\Config;
use Friendica\Database\DBA;
use Friendica\Database\PostUpdate;
use Friendica\Model\Contact;
use Friendica\Model\GContact;
use Friendica\Model\Photo;
@ -211,7 +210,7 @@ class CronJobs
// So optimize it
logger("Optimize Table " . $table["Name"], LOGGER_DEBUG);
q("OPTIMIZE TABLE `%s`", dbesc($table["Name"]));
q("OPTIMIZE TABLE `%s`", DBA::escape($table["Name"]));
}
}
@ -229,7 +228,7 @@ class CronJobs
$r = q("SELECT `id`, `url` FROM `contact`
WHERE `network` = '%s' AND (`batch` = '' OR `notify` = '' OR `poll` = '' OR pubkey = '')
ORDER BY RAND() LIMIT 50", dbesc(NETWORK_DIASPORA));
ORDER BY RAND() LIMIT 50", DBA::escape(NETWORK_DIASPORA));
if (!DBA::isResult($r)) {
return;
}
@ -251,7 +250,7 @@ class CronJobs
logger("Repair contact " . $contact["id"] . " " . $contact["url"], LOGGER_DEBUG);
q("UPDATE `contact` SET `batch` = '%s', `notify` = '%s', `poll` = '%s', pubkey = '%s' WHERE `id` = %d",
dbesc($data["batch"]), dbesc($data["notify"]), dbesc($data["poll"]), dbesc($data["pubkey"]),
DBA::escape($data["batch"]), DBA::escape($data["notify"]), DBA::escape($data["poll"]), DBA::escape($data["pubkey"]),
intval($contact["id"]));
}
}

4
src/Worker/DiscoverPoCo.php
View file

@ -147,8 +147,8 @@ class DiscoverPoCo
WHERE `last_contact` < UTC_TIMESTAMP - INTERVAL 1 MONTH AND
`last_failure` < UTC_TIMESTAMP - INTERVAL 1 MONTH AND
`network` IN ('%s', '%s', '%s', '%s', '') ORDER BY rand()",
dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA),
dbesc(NETWORK_OSTATUS), dbesc(NETWORK_FEED));
DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA),
DBA::escape(NETWORK_OSTATUS), DBA::escape(NETWORK_FEED));
if (!$users) {
return;

4
src/Worker/GProbe.php
View file

@ -20,7 +20,7 @@ class GProbe {
$r = q(
"SELECT `id`, `url`, `network` FROM `gcontact` WHERE `nurl` = '%s' ORDER BY `id` LIMIT 1",
dbesc(normalise_link($url))
DBA::escape(normalise_link($url))
);
logger("gprobe start for ".normalise_link($url), LOGGER_DEBUG);
@ -49,7 +49,7 @@ class GProbe {
$r = q(
"SELECT `id`, `url`, `network` FROM `gcontact` WHERE `nurl` = '%s' ORDER BY `id` LIMIT 1",
dbesc(normalise_link($url))
DBA::escape(normalise_link($url))
);
}
if (DBA::isResult($r)) {

10
src/Worker/Notifier.php
View file

@ -238,7 +238,7 @@ class Notifier
// local followup to remote post
$followup = true;
$public_message = false; // not public
$conversant_str = dbesc($parent['contact-id']);
$conversant_str = DBA::escape($parent['contact-id']);
$recipients = [$parent['contact-id']];
$recipients_followup = [$parent['contact-id']];
@ -258,7 +258,7 @@ class Notifier
// Currently it is work at progress
$r = q("SELECT `id` FROM `contact` WHERE `uid` = %d AND `network` = '%s' AND NOT `blocked` AND NOT `pending` AND NOT `archive`",
intval($uid),
dbesc(NETWORK_DFRN)
DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {
foreach ($r as $rr) {
@ -331,7 +331,7 @@ class Notifier
$deny = array_unique(array_merge($deny_people,$deny_groups));
$recipients = array_diff($recipients,$deny);
$conversant_str = dbesc(implode(', ',$conversants));
$conversant_str = DBA::escape(implode(', ',$conversants));
}
// If the thread parent is OStatus then do some magic to distribute the messages.
@ -385,7 +385,7 @@ class Notifier
&& intval($target_item['pubmail'])) {
$r = q("SELECT `id` FROM `contact` WHERE `uid` = %d AND `network` = '%s'",
intval($uid),
dbesc(NETWORK_MAIL)
DBA::escape(NETWORK_MAIL)
);
if (DBA::isResult($r)) {
foreach ($r as $rr) {
@ -440,7 +440,7 @@ class Notifier
$r1 = q("SELECT `batch`, ANY_VALUE(`id`) AS `id`, ANY_VALUE(`name`) AS `name`, ANY_VALUE(`network`) AS `network`
FROM `contact` WHERE `network` = '%s' AND `batch` != ''
AND `uid` = %d AND `rel` != %d AND NOT `blocked` AND NOT `pending` AND NOT `archive` GROUP BY `batch`",
dbesc(NETWORK_DIASPORA),
DBA::escape(NETWORK_DIASPORA),
intval($owner['uid']),
intval(CONTACT_IS_SHARING)
);

24
src/Worker/UpdateGContact.php
View file

@ -40,7 +40,7 @@ class UpdateGContact
}
q("UPDATE `gcontact` SET `last_failure` = '%s' WHERE `id` = %d",
dbesc(DateTimeFormat::utcNow()), intval($contact_id));
DBA::escape(DateTimeFormat::utcNow()), intval($contact_id));
return;
}
@ -63,26 +63,26 @@ class UpdateGContact
q("UPDATE `gcontact` SET `name` = '%s', `nick` = '%s', `addr` = '%s', `photo` = '%s'
WHERE `id` = %d",
dbesc($data["name"]),
dbesc($data["nick"]),
dbesc($data["addr"]),
dbesc($data["photo"]),
DBA::escape($data["name"]),
DBA::escape($data["nick"]),
DBA::escape($data["addr"]),
DBA::escape($data["photo"]),
intval($contact_id)
);
q("UPDATE `contact` SET `name` = '%s', `nick` = '%s', `addr` = '%s', `photo` = '%s'
WHERE `uid` = 0 AND `addr` = '' AND `nurl` = '%s'",
dbesc($data["name"]),
dbesc($data["nick"]),
dbesc($data["addr"]),
dbesc($data["photo"]),
dbesc(normalise_link($data["url"]))
DBA::escape($data["name"]),
DBA::escape($data["nick"]),
DBA::escape($data["addr"]),
DBA::escape($data["photo"]),
DBA::escape(normalise_link($data["url"]))
);
q("UPDATE `contact` SET `addr` = '%s'
WHERE `uid` != 0 AND `addr` = '' AND `nurl` = '%s'",
dbesc($data["addr"]),
dbesc(normalise_link($data["url"]))
DBA::escape($data["addr"]),
DBA::escape(normalise_link($data["url"]))
);
}
}

12
update.php
View file

@ -49,10 +49,10 @@ function update_1178() {
$profile["pub_keywords"] = profile_clean_keywords($profile["pub_keywords"]);
$r = q("UPDATE `contact` SET `about` = '%s', `location` = '%s', `keywords` = '%s', `gender` = '%s' WHERE `self` AND `uid` = %d",
dbesc($profile["about"]),
dbesc($profile["locality"]),
dbesc($profile["pub_keywords"]),
dbesc($profile["gender"]),
DBA::escape($profile["about"]),
DBA::escape($profile["locality"]),
DBA::escape($profile["pub_keywords"]),
DBA::escape($profile["gender"]),
intval($profile["uid"])
);
}
@ -112,7 +112,7 @@ function update_1191() {
// select old formlist addon entries
$r = q("SELECT `uid`, `cat`, `k`, `v` FROM `pconfig` WHERE `cat` = '%s' ",
dbesc('forumlist')
DBA::escape('forumlist')
);
// convert old forumlist addon entries in new config entries
@ -149,7 +149,7 @@ function update_1191() {
function update_1203() {
$r = q("UPDATE `user` SET `account-type` = %d WHERE `page-flags` IN (%d, %d)",
dbesc(ACCOUNT_TYPE_COMMUNITY), dbesc(PAGE_COMMUNITY), dbesc(PAGE_PRVGROUP));
DBA::escape(ACCOUNT_TYPE_COMMUNITY), DBA::escape(PAGE_COMMUNITY), DBA::escape(PAGE_PRVGROUP));
}
function update_1244() {

8
view/theme/frio/theme.php
View file

@ -239,7 +239,7 @@ function frio_remote_nav($a, &$nav)
} elseif (Profile::getMyURL()) {
$r = q("SELECT `name`, `nick`, `photo` FROM `gcontact`
WHERE `addr` = '%s' AND `network` = 'dfrn'",
dbesc($webbie));
DBA::escape($webbie));
$nav['remote'] = L10n::t('Visitor');
} else {
$r = false;
@ -299,12 +299,12 @@ function frio_acl_lookup(App $a, &$results)
$sql_extra = '';
if ($results['search']) {
$search_txt = dbesc(protect_sprintf(preg_quote($results['search'])));
$sql_extra .= " AND (`attag` LIKE '%%" . dbesc($search_txt) . "%%' OR `name` LIKE '%%" . dbesc($search_txt) . "%%' OR `nick` LIKE '%%" . dbesc($search_txt) . "%%') ";
$search_txt = DBA::escape(protect_sprintf(preg_quote($results['search'])));
$sql_extra .= " AND (`attag` LIKE '%%" . $search_txt . "%%' OR `name` LIKE '%%" . $search_txt . "%%' OR `nick` LIKE '%%" . $search_txt . "%%') ";
}
if ($nets) {
$sql_extra .= sprintf(" AND network = '%s' ", dbesc($nets));
$sql_extra .= sprintf(" AND network = '%s' ", DBA::escape($nets));
}
$total = 0;

5
view/theme/vier/theme.php
View file

@ -12,14 +12,13 @@
use Friendica\App;
use Friendica\Content\ForumManager;
use Friendica\Core\Addon;
use Friendica\Core\L10n;
use Friendica\Core\Config;
use Friendica\Core\L10n;
use Friendica\Core\PConfig;
use Friendica\Core\System;
use Friendica\Database\DBA;
use Friendica\Model\Contact;
use Friendica\Model\GContact;
use Friendica\Model\Profile;
require_once "mod/proxy.php";
@ -278,7 +277,7 @@ function vier_community_info()
$query .= ",";
}
$query .= "'".dbesc(normalise_link(trim($helper)))."'";
$query .= "'".DBA::escape(normalise_link(trim($helper)))."'";
}
$r = q("SELECT `url`, `name` FROM `gcontact` WHERE `nurl` IN (%s)", $query);