Bugfix for pictures that weren't stored / reworked database calls

include/Contact.php

@@ -9,27 +9,27 @@ use Friendica\Network\Probe;
 // authorisation to do this.
 
 function user_remove($uid) {
-	if(! $uid)
+	if (!$uid) {
 		return;
+	}
+
 	logger('Removing user: ' . $uid);
 
-	$r = q("select * from user where uid = %d limit 1", intval($uid));
+	$r = dba::select('user', array(), array('uid' => $uid), array("limit" => 1));
 
-	call_hooks('remove_user',$r[0]);
+	call_hooks('remove_user',$r);
 
 	// save username (actually the nickname as it is guaranteed
 	// unique), so it cannot be re-registered in the future.
 
-	q("insert into userd ( username ) values ( '%s' )",
+	dba::insert('userd', array('username' => $r['nickname']));
-		$r[0]['nickname']
-	);
 
 	// The user and related data will be deleted in "cron_expire_and_remove_users" (cronjobs.php)
 	q("UPDATE `user` SET `account_removed` = 1, `account_expires_on` = UTC_TIMESTAMP() WHERE `uid` = %d", intval($uid));
 	proc_run(PRIORITY_HIGH, "include/notifier.php", "removeme", $uid);
 
 	// Send an update to the directory
-	proc_run(PRIORITY_LOW, "include/directory.php", $r[0]['url']);
+	proc_run(PRIORITY_LOW, "include/directory.php", $r['url']);
 
 	if($uid == local_user()) {
 		unset($_SESSION['authenticated']);

include/Photo.php

@@ -628,92 +628,24 @@ class Photo {
 
 	public function store($uid, $cid, $rid, $filename, $album, $scale, $profile = 0, $allow_cid = '', $allow_gid = '', $deny_cid = '', $deny_gid = '', $desc = '') {
 
-		$r = q("SELECT `guid` FROM `photo` WHERE `resource-id` = '%s' AND `guid` != '' LIMIT 1",
+		$r = dba::select('photo', array('guid'), array("`resource-id` = ? AND `guid` != ?", $rid, ''), array('limit' => 1));
-			dbesc($rid)
-		);
 		if (dbm::is_result($r)) {
-			$guid = $r[0]['guid'];
+			$guid = $r['guid'];
 		} else {
 			$guid = get_guid();
 		}
 
-		$x = q("SELECT `id` FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `contact-id` = %d AND `scale` = %d LIMIT 1",
+		$x = dba::select('photo', array('id'), array('resource-id' => $rid, 'uid' => $uid, 'contact-id' => $cid, 'scale' => $scale), array('limit' => 1));
-			dbesc($rid),
-			intval($uid),
-			intval($cid),
-			intval($scale)
-		);
-		if (dbm::is_result($x)) {
-			$r = q("UPDATE `photo`
-				SET `uid` = %d,
-				`contact-id` = %d,
-				`guid` = '%s',
-				`resource-id` = '%s',
-				`created` = '%s',
-				`edited` = '%s',
-				`filename` = '%s',
-				`type` = '%s',
-				`album` = '%s',
-				`height` = %d,
-				`width` = %d,
-				`datasize` = %d,
-				`data` = '%s',
-				`scale` = %d,
-				`profile` = %d,
-				`allow_cid` = '%s',
-				`allow_gid` = '%s',
-				`deny_cid` = '%s',
-				`deny_gid` = '%s',
-				`desc` = '%s'
-				WHERE `id` = %d",
 
-				intval($uid),
+		$fields = array('uid' => $uid, 'contact-id' => $cid, 'guid' => $guid, 'resource-id' => $rid, 'created' => datetime_convert(), 'edited' => datetime_convert(),
-				intval($cid),
+				'filename' => basename($filename), 'type' => $this->getType(), 'album' => $album, 'height' => $this->getHeight(), 'width' => $this->getWidth(),
-				dbesc($guid),
+				'datasize' => strlen($this->imageString()), 'data' => $this->imageString(), 'scale' => $scale, 'profile' => $profile,
-				dbesc($rid),
+				'allow_cid' => $allow_cid, 'allow_gid' => $allow_gid, 'deny_cid' => $deny_cid, 'deny_gid' => $deny_gid, 'desc' => $desc);
-				dbesc(datetime_convert()),
+
-				dbesc(datetime_convert()),
+		if (dbm::is_result($x)) {
-				dbesc(basename($filename)),
+			$r = dba::update('photo', $fields, array('id' => $x['id']));
-				dbesc($this->getType()),
-				dbesc($album),
-				intval($this->getHeight()),
-				intval($this->getWidth()),
-				dbesc(strlen($this->imageString())),
-				dbesc($this->imageString()),
-				intval($scale),
-				intval($profile),
-				dbesc($allow_cid),
-				dbesc($allow_gid),
-				dbesc($deny_cid),
-				dbesc($deny_gid),
-				dbesc($desc),
-				intval($x[0]['id'])
-			);
 		} else {
-			$r = q("INSERT INTO `photo`
+			$r = dba::insert('photo', $fields);
-				(`uid`, `contact-id`, `guid`, `resource-id`, `created`, `edited`, `filename`, type, `album`, `height`, `width`, `datasize`, `data`, `scale`, `profile`, `allow_cid`, `allow_gid`, `deny_cid`, `deny_gid`, `desc`)
-				VALUES (%d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, %d, '%s', %d, %d, '%s', '%s', '%s', '%s', '%s')",
-				intval($uid),
-				intval($cid),
-				dbesc($guid),
-				dbesc($rid),
-				dbesc(datetime_convert()),
-				dbesc(datetime_convert()),
-				dbesc(basename($filename)),
-				dbesc($this->getType()),
-				dbesc($album),
-				intval($this->getHeight()),
-				intval($this->getWidth()),
-				dbesc(strlen($this->imageString())),
-				dbesc($this->imageString()),
-				intval($scale),
-				intval($profile),
-				dbesc($allow_cid),
-				dbesc($allow_gid),
-				dbesc($deny_cid),
-				dbesc($deny_gid),
-				dbesc($desc)
-			);
 		}
 
 		return $r;

include/dba.php

@@ -1400,37 +1400,6 @@ function qu($sql) {
 	return false;
 }
 
-/**
- *
- * Raw db query, no arguments
- *
- */
-function dbq($sql) {
-	global $db;
-
-	if ($db && $db->connected) {
-		$ret = $db->q($sql);
-	} else {
-		$ret = false;
-	}
-	return $ret;
-}
-
-// Caller is responsible for ensuring that any integer arguments to
-// dbesc_array are actually integers and not malformed strings containing
-// SQL injection vectors. All integer array elements should be specifically
-// cast to int to avoid trouble.
-function dbesc_array_cb(&$item, $key) {
-	if (is_string($item))
-		$item = dbesc($item);
-}
-
-function dbesc_array(&$arr) {
-	if (is_array($arr) && count($arr)) {
-		array_walk($arr,'dbesc_array_cb');
-	}
-}
-
 function dba_timer() {
 	return microtime(true);
 }

include/dfrn.php

@@ -1669,9 +1669,7 @@ class dfrn {
 		$msg["seen"] = 0;
 		$msg["replied"] = 0;
 
-		dbm::esc_array($msg, true);
+		dba::insert('mail', $msg);
-
-		$r = dbq("INSERT INTO `mail` (`".implode("`, `", array_keys($msg))."`) VALUES (".implode(", ", array_values($msg)).")");
 
 		// send notifications.
 		/// @TODO Arange this mess

include/message.php

@@ -60,22 +60,14 @@ function send_message($recipient=0, $body='', $subject='', $replyto=''){
 
 		$handles = $recip_handle . ';' . $sender_handle;
 
-		$r = q("insert into conv (uid,guid,creator,created,updated,subject,recips) values(%d, '%s', '%s', '%s', '%s', '%s', '%s') ",
+		$fields = array('uid' => local_user(), 'guid' => $conv_guid, 'creator' => $sender_handle,
-			intval(local_user()),
+				'created' => datetime_convert(), 'updated' => datetime_convert(),
-			dbesc($conv_guid),
+				'subject' => $subject, 'recips' => $handles);
-			dbesc($sender_handle),
+		$r = dba::insert('conv', $fields);
-			dbesc(datetime_convert()),
-			dbesc(datetime_convert()),
-			dbesc($subject),
-			dbesc($handles)
-		);
 
-		$r = q("select * from conv where guid = '%s' and uid = %d limit 1",
+		$r = dba::select('conv', array('id', array('guid' => $conv_guid, 'uid' => local_user())), array('limit' => 1));
-			dbesc($conv_guid),
-			intval(local_user())
-		);
 		if (dbm::is_result($r))
-			$convid = $r[0]['id'];
+			$convid = $r['id'];
 	}
 
 	if (! $convid) {
@@ -194,28 +186,18 @@ function send_wallmessage($recipient='', $body='', $subject='', $replyto=''){
 
 	$handles = $recip_handle . ';' . $sender_handle;
 
-	$r = q("INSERT INTO `conv` (`uid`,`guid`,`creator`,`created`,`updated`,`subject`,`recips`) values(%d, '%s', '%s', '%s', '%s', '%s', '%s') ",
+	$fields = array('uid' => $recipient['uid'], 'guid' => $conv_guid, 'creator' => $sender_handle,
-		intval($recipient['uid']),
+			'created' => datetime_convert(), 'updated' => datetime_convert(),
-		dbesc($conv_guid),
+			'subject' => $subject, 'recips' => $handles);
-		dbesc($sender_handle),
+	$r = dba::insert('conv', $fields);
-		dbesc(datetime_convert()),
-		dbesc(datetime_convert()),
-		dbesc($subject),
-		dbesc($handles)
-	);
-
-	$r = q("SELECT * FROM `conv` WHERE `guid` = '%s' AND `uid` = %d LIMIT 1",
-		dbesc($conv_guid),
-		intval($recipient['uid'])
-	);
-
 
+	$r = dba::select('conv', array('id', array('guid' => $conv_guid, 'uid' => $recipient['uid'])), array('limit' => 1));
 	if (!dbm::is_result($r)) {
 		logger('send message: conversation not found.');
 		return -4;
 	}
 
-	$convid = $r[0]['id'];
+	$convid = $r['id'];
 
 	$r = q("INSERT INTO `mail` ( `uid`, `guid`, `convid`, `from-name`, `from-photo`, `from-url`,
 		`contact-id`, `title`, `body`, `seen`, `reply`, `replied`, `uri`, `parent-uri`, `created`, `unknown`)

include/threads.php

@@ -16,11 +16,7 @@ function add_thread($itemid, $onlyshadow = false) {
 	$item['iid'] = $itemid;
 
 	if (!$onlyshadow) {
-		$result = dbq("INSERT INTO `thread` (`"
+		$result = dba::insert('thread', $item);
-				.implode("`, `", array_keys($item))
-				."`) VALUES ('"
-				.implode("', '", array_values($item))
-				."')");
 
 		logger("Add thread for item ".$itemid." - ".print_r($result, true), LOGGER_DEBUG);
 	}

mod/delegate.php

@@ -35,10 +35,7 @@ function delegate_content(App $a) {
 				dbesc(normalise_link(System::baseUrl() . '/profile/' . $r[0]['nickname']))
 			);
 			if (dbm::is_result($r)) {
-				q("insert into manage ( uid, mid ) values ( %d , %d ) ",
+				dba::insert('manage', array('uid' => $a->argv[2], 'mid' => local_user()));
-					intval($a->argv[2]),
-					intval(local_user())
-				);
 			}
 		}
 		goaway(System::baseUrl() . '/delegate');

mod/profiles.php

@@ -108,13 +108,7 @@ function profiles_init(App $a) {
 		$r1[0]['net-publish'] = 0;
 		$r1[0]['profile-name'] = dbesc($name);
 
-		dbm::esc_array($r1[0], true);
+		dba::insert('profile', $r1[0]);
-
-		$r2 = dbq("INSERT INTO `profile` (`"
-			. implode("`, `", array_keys($r1[0]))
-			. "`) VALUES ("
-			. implode(", ", array_values($r1[0]))
-			. ")" );
 
 		$r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
 			intval(local_user()),

mod/proxy.php

@@ -142,10 +142,10 @@ function proxy_init(App $a) {
 	$r = array();
 
 	if (!$direct_cache && ($cachefile == '')) {
-		$r = qu("SELECT * FROM `photo` WHERE `resource-id` = '%s' LIMIT 1", $urlhash);
+		$r = dba::select('photo', array('data', 'desc'), array('resource-id' => $urlhash), array('limit' => 1));
 		if (dbm::is_result($r)) {
-			$img_str = $r[0]['data'];
+			$img_str = $r['data'];
-			$mime = $r[0]['desc'];
+			$mime = $r['desc'];
 			if ($mime == '') {
 				$mime = 'image/jpeg';
 			}
@@ -181,23 +181,11 @@ function proxy_init(App $a) {
 				die();
 			}
 
-			q("INSERT INTO `photo`
+			$fields = array('uid' => 0, 'contact-id' => 0, 'guid' => get_guid(), 'resource-id' => $urlhash, 'created' => datetime_convert(), 'edited' => datetime_convert(),
-			( `uid`, `contact-id`, `guid`, `resource-id`, `created`, `edited`, `filename`, `album`, `height`, `width`, `desc`, `data`, `scale`, `profile`, `allow_cid`, `allow_gid`, `deny_cid`, `deny_gid` )
+				'filename' => basename($_REQUEST['url']), 'type' => '', 'album' => '', 'height' => imagesy($image), 'width' => imagesx($image),
-			VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', '%s', %d, %d, '%s', '%s', '%s', '%s' )",
+				'datasize' => 0, 'data' => $img_str, 'scale' => 100, 'profile' => 0,
-				0, 0, get_guid(), dbesc($urlhash),
+				'allow_cid' => '', 'allow_gid' => '', 'deny_cid' => '', 'deny_gid' => '', 'desc' => $mime);
-				dbesc(datetime_convert()),
+			dba::insert('photo', $fields);
-				dbesc(datetime_convert()),
-				dbesc(basename(dbesc($_REQUEST['url']))),
-				dbesc(''),
-				intval(imagesy($image)),
-				intval(imagesx($image)),
-				$mime,
-				dbesc($img_str),
-				100,
-				intval(0),
-				dbesc(''), dbesc(''), dbesc(''), dbesc('')
-			);
-
 		} else {
 			$img = new Photo($img_str, $mime);
 			if ($img->is_valid() && !$direct_cache && ($cachefile == '')) {

mod/search.php

@@ -57,23 +57,16 @@ function search_init(App $a) {
 				dbesc($search)
 			);
 			if (!dbm::is_result($r)) {
-				q("INSERT INTO `search` (`uid`,`term`) VALUES ( %d, '%s')",
+				dbm::insert('search', array('uid' => local_user(), 'term' => $search));
-					intval(local_user()),
-					dbesc($search)
-				);
 			}
 		}
 		if (x($_GET,'remove') && $search) {
-			q("DELETE FROM `search` WHERE `uid` = %d AND `term` = '%s' LIMIT 1",
+			dbm::delete('search', array('uid' => local_user(), 'term' => $search));
-				intval(local_user()),
-				dbesc($search)
-			);
 		}
 
 		$a->page['aside'] .= search_saved_searches();
 
-	}
+	} else {
-	else {
 		unset($_SESSION['theme']);
 		unset($_SESSION['mobile-theme']);
 	}

mod/settings.php

@@ -231,17 +231,12 @@ function settings_post(App $a) {
 					intval(local_user())
 				);
 				if (! dbm::is_result($r)) {
-					q("INSERT INTO `mailacct` (`uid`) VALUES (%d)",
+					dba::insert('mailacct', array('uid' => local_user()));
-						intval(local_user())
-					);
 				}
 				if(strlen($mail_pass)) {
 					$pass = '';
 					openssl_public_encrypt($mail_pass,$pass,$a->user['pubkey']);
-					q("UPDATE `mailacct` SET `pass` = '%s' WHERE `uid` = %d",
+					dba::update('mailacct', array('pass' => bin2hex($pass)), array('uid' => local_user()));
-						dbesc(bin2hex($pass)),
-						intval(local_user())
-					);
 				}
 				$r = q("UPDATE `mailacct` SET `server` = '%s', `port` = %d, `ssltype` = '%s', `user` = '%s',
 					`action` = %d, `movetofolder` = '%s',

mod/suggest.php

@@ -39,10 +39,7 @@ function suggest_init(App $a) {
 		}
 		// Now check how the user responded to the confirmation query
 		if (!$_REQUEST['canceled']) {
-			q("INSERT INTO `gcign` ( `uid`, `gcid` ) VALUES ( %d, %d ) ",
+			dba::insert('gcign', array('uid' => local_user(), 'gcid' => $_GET['ignore']));
-				intval(local_user()),
-				intval($_GET['ignore'])
-			);
 		}
 	}