@ -497,7 +497,7 @@ function editlinkcategory($type)
if ($submitCategory)
{
$sql = "UPDATE ".$tbl_categories." set category_title='".Database::escape_string(Security::remove_XSS($_POST['category_title']))."', description='".Database::escape_string(Security::remove_XSS($_POST['description']))."' WHERE id='".Database::escape_string(Security::remove_XSS($_POST['id']))."'";
$sqlLinks = "SELECT * FROM ".$tbl_link." link, ".$TABLE_ITEM_PROPERTY." itemproperties WHERE itemproperties.tool='".TOOL_LINK."' AND link.id=itemproperties.ref AND link.category_id='".$catid."' AND (itemproperties.visibility='0' OR itemproperties.visibility='1')ORDER BY link.display_order DESC";
$result = api_sql_query($sqlLinks);
$result = Database::query($sqlLinks);
$numberoflinks = Database::num_rows($result);
echo '<tableclass="data_table"width="100%">';
@ -690,7 +690,7 @@ function movecatlink($catlinkid)
if(!empty($thiscatlinkId))
{
$sql = "SELECT category_id from ".$movetable." WHERE id='$thiscatlinkId'";
$sql = "SELECT COUNT(*) as count FROM $table_message WHERE user_sender_id = ".api_get_user_id()." AND user_receiver_id='".Database::escape_string($receiver_user_id)."' AND title = '".Database::escape_string($title)."' AND content ='".Database::escape_string($content)."' ";
$query = "UPDATE $table_message SET msg_status = '0' WHERE msg_status<>4 AND user_receiver_id=".Database::escape_string($user_id)." AND id='".Database::escape_string($id)."'";
if (isset($_GET['id_send']) && is_numeric($_GET['id_send'])) {
$query = "SELECT * FROM $table_message WHERE user_sender_id=".api_get_user_id()." AND id=".Database::escape_string($_GET['id_send'])." AND msg_status=4;";
$query = "SELECT * FROM $table_message WHERE msg_status<>4 AND user_receiver_id=".api_get_user_id()." AND id='".Database::escape_string($_GET['id'])."';";
$query = "SELECT * FROM $table_message WHERE user_sender_id=".api_get_user_id()." AND id=".Database::escape_string($_GET['id_send'])." AND msg_status=4;";
$sql = "SELECT id FROM $scormdocument WHERE path='". Database::escape_string(api_substr($workWith,1)) . "' OR path='". Database::escape_string(substr($workWith,1)) . "/.'";
$sql_verified='SELECT status FROM '.$item_view_table.' WHERE lp_item_id="'.$this->db_id.'" AND lp_view_id="'.$this->view_id.'" AND view_count="'.$this->attempt_id.'" ;';
$sql_verified='SELECT status FROM '.$item_view_table.' WHERE lp_item_id="'.$this->db_id.'" AND lp_view_id="'.$this->view_id.'" AND view_count="'.$this->attempt_id.'" ;';
while ($ar2 = Database::fetch_array($result_items2))
{
if ($ar2['prerequisite'] != '')
@ -909,7 +909,7 @@ function prereqcheck($id_in_path)
//3 Get item data from the database
$sql_items = "SELECT * FROM $tbl_learnpath_item WHERE id='$id_in_path'";
$result_items = api_sql_query($sql_items);
$result_items = Database::query($sql_items);
$row = mysql_fetch_array($result_items);
//4 Check prerequisite's type
if ($row['prereq_type'] == 'i')
@ -929,7 +929,7 @@ function prereqcheck($id_in_path)
$user_id = $_user['user_id'];
}
$sql_items3 = "SELECT * FROM $tbl_learnpath_user WHERE (learnpath_item_id='$id_in_path3' and user_id=$user_id)";
$result_items3 = api_sql_query($sql_items3);
$result_items3 = Database::query($sql_items3);
$row3 = mysql_fetch_array($result_items3);
//4.a.3 Get the link that needs to be shown for the current item (not the prereq)
@ -939,7 +939,7 @@ function prereqcheck($id_in_path)
//4.a.4 Get the prerequisite item
$sql6 = "SELECT * FROM $tbl_learnpath_item WHERE (id='$id_in_path3')";
$result6 = api_sql_query($sql6);
$result6 = Database::query($sql6);
$row6 = mysql_fetch_array($result6);
//4.a.5 Get a link to the prerequisite item
$prereqname = display_addedresource_link_in_learnpath($row6['item_type'], $row6['ref'], '', $id_in_path3, 'builder', 'nolink'); //this is the prereq of the step we want to open
@ -984,7 +984,7 @@ function prereqcheck($id_in_path)
$id_in_path2 = $row['prereq_id'];
//4.b.2 Get all items in the prerequisite chapter
$sql_items3 = "SELECT * FROM $tbl_lp_item WHERE parent_item_id='$id_in_path2'";
$result_items3 = api_sql_query($sql_items3);
$result_items3 = Database::query($sql_items3);
$allcompleted = true;
while ($row3 = mysql_fetch_array($result_items3))
{
@ -1001,7 +1001,7 @@ function prereqcheck($id_in_path)
}
//4.b.3.2 Get user-item relation
$sql_items4 = "SELECT * FROM $tbl_learnpath_user WHERE (learnpath_item_id='$id_in_path4' and user_id=$user_id)";
$result_items4 = api_sql_query($sql_items4);
$result_items4 = Database::query($sql_items4);
$row4 = mysql_fetch_array($result_items4);
//4.b.3.3 If any of these elements is not 'completed', the overall completion status is false
if ($row4['status'] != "completed" and $row4['status'] != 'passed')
@ -1018,7 +1018,7 @@ function prereqcheck($id_in_path)
{
//4.b.4.b Something was not completed. Return corresponding message
$sql5 = "SELECT * FROM $tbl_learnpath_chapter WHERE (lp_id='$learnpath_id' and id='$id_in_path2')";
@ -169,13 +169,13 @@ function save_item($lp_id,$user_id,$view_id,$item_id,$score=-1,$max=-1,$min=-1,$
$sql_last_connection="SELECT login_id, login_date FROM $tbl_track_login WHERE login_user_id='".api_get_user_id()."' ORDER BY login_date DESC LIMIT 0,1";
@ -178,13 +178,13 @@ function save_item($lp_id,$user_id,$view_id,$item_id,$score=-1,$max=-1,$min=-1,$
$sql_last_connection="SELECT login_id, login_date FROM $tbl_track_login WHERE login_user_id='".api_get_user_id()."' ORDER BY login_date DESC LIMIT 0,1";
if (Database::num_rows($res_result_disabled) > 0 && (int)$row_result_disabled[0]===1) {
@ -442,7 +442,7 @@ if (is_array($list) && count($list) > 0){
$sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . $student_id . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . $course_code . '" AND status <> "incomplete" ORDER BY exe_date DESC limit 1';
@ -540,7 +540,7 @@ if (is_array($list) && count($list) > 0){
$sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . $student_id . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . Database :: escape_string($_GET['course']) . '" AND status <> "incomplete" ORDER BY exe_date DESC ';
$sql_last_attempt = "SELECT id FROM $TBL_LP_ITEM_VIEW WHERE lp_item_id = '$safe_item_id' AND lp_view_id = '".$_SESSION['oLP']->lp_view_id."' order by id desc limit 1";
$sql="SELECT * from $document_table, $item_property_table WHERE id=ref AND tool = '".TOOL_DOCUMENT."' AND $visibility AND to_group_id = 0 AND to_user_id IS NULL ORDER BY path ASC";
$result=api_sql_query($sql,__FILE__,__LINE__);
$result=Database::query($sql,__FILE__,__LINE__);
while ($row=mysql_fetch_array($result))
{
if (!$folder)
@ -248,7 +248,7 @@ function store_resources($source_type, $source_id)
$result = api_sql_query("SELECT * FROM `$tbl_posts` posts, `$TBL_FORUMS` forum WHERE forum.forum_id=posts.forum_id and post_id=$id",__FILE__,__LINE__);
$result = Database::query("SELECT * FROM `$tbl_posts` posts, `$TBL_FORUMS` forum WHERE forum.forum_id=posts.forum_id and post_id=$id",__FILE__,__LINE__);
$myrow = mysql_fetch_array($result);
// grabbing the title of the post
$sql_title = "SELECT * FROM `$tbl_posts_text` WHERE post_id=".$myrow["post_id"];
$sql="DELETE FROM `$TABLERESOURCE` WHERE source_type='$source_type' and source_id='$source_id' and resource_type='$resource_type' and resource_id='$resource_id'";
api_sql_query($sql,__FILE__,__LINE__);
Database::query($sql,__FILE__,__LINE__);
}
/**
@ -1488,7 +1488,7 @@ function delete_added_resource($type, $id)
$sql = "SELECT * FROM ".$tbl_announcement." a, ".$item_property_table." i WHERE i.tool = '".TOOL_ANNOUNCEMENT."' AND a.id=i.ref AND i.visibility='1' AND i.to_group_id = 0 AND i.to_user_id IS NULL ORDER BY a.display_order ASC";
$sql = "SELECT * FROM ".$TBL_FORUMS." forums, ".$TBL_CATAGORIES." categories WHERE forums.forum_category=categories.cat_id ORDER BY forums.forum_category DESC";
// showing the links that are in the root (having no category)
$sql = "SELECT * FROM ".$link_table.", ".$item_property_table." WHERE (category_id=0 or category_id IS NULL) AND tool = '".TOOL_LINK."' AND id=ref AND visibility='1'";
$sqlcategories = "SELECT * FROM ".$tbl_categories." ORDER by display_order DESC";
$resultcategories = api_sql_query($sqlcategories) or die;
$resultcategories = Database::query($sqlcategories) or die;
while ($myrow = @ mysql_fetch_array($resultcategories))
{
$sql_links = "SELECT * FROM ".$link_table.", ".$item_property_table." WHERE category_id='".$myrow["id"]."' AND tool = '".TOOL_LINK."' AND id=ref AND visibility='1' ORDER BY display_order DESC";
$sql="UPDATE $tbl_tool set name='".domesticate($learnpath_name)."' where (link='$l' and image='scormbuilder.gif')";
$result=api_sql_query($sql,__FILE__,__LINE__);
$result=Database::query($sql,__FILE__,__LINE__);
$sql ="UPDATE $tbl_learnpath_main SET learnpath_name='".domesticate($learnpath_name)."', learnpath_description='".domesticate($learnpath_description)."' WHERE learnpath_id=$id";
$result=api_sql_query($sql,__FILE__,__LINE__);
$result=Database::query($sql,__FILE__,__LINE__);
$dialogBox=get_lang('_learnpath_edited');
}
break;
@ -180,10 +180,10 @@ switch($action){
if (!empty($Submit))
{
$sql ="INSERT INTO $tbl_learnpath_main (learnpath_name, learnpath_description) VALUES ('".domesticate($learnpath_name)."','".domesticate($learnpath_description)."')";
$query="SELECT t1.user_id,username,picture_uri,t2.status FROM $tbl_user t1,$tbl_course_user t2 WHERE t1.user_id=t2.user_id AND course_code='$_cid' AND (t1.user_id='".$_user['user_id']."' OR t2.status='1')";
$query="SELECT t1.user_id,t1.username,t1.firstname,t1.lastname,t1.picture_uri,t3.status FROM $tbl_user t1,$tbl_online_connected t2,$tbl_course_user t3 WHERE t1.user_id=t2.user_id AND t3.user_id=t1.user_id AND t3.course_code = '".$_course[sysCode]."' AND t2.last_connection>'".date('Y-m-d H:i:s',time()-60*5)."' ORDER BY t1.username";
@ -110,7 +110,7 @@ function store_one_permission($content, $action, $id, $tool,$permission)
if($action=='revoke')
{
$sql="DELETE FROM $table WHERE $id_field = '".mysql_real_escape_string($id)."' AND tool='".mysql_real_escape_string($tool)."' AND action='".mysql_real_escape_string($permission)."'";
@ -504,7 +504,7 @@ function get_roles($content,$id, $scope='course')
$current_roles=array();
//$sql="SELECT role.role_id FROM $table role_group_user, $table_role role WHERE role_group_user.$id_field = '$id' AND role_group_user.role_id=role.role_id AND role_group_user.scope='".$scope."'";$sql="SELECT role.role_id FROM $table role_group_user, $table_role role WHERE role_group_user.$id_field = '$id' AND role_group_user.role_id=role.role_id AND role_group_user.scope='".$scope."'";
$sql="SELECT role_id FROM $table WHERE $id_field = '$id' AND scope='".$scope."'";
$sql = "INSERT INTO ".Rsys :: getTable("category")." (name) VALUES ('".Database::escape_string($naam)."')";
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
return Database::get_last_insert_id();
}
return false;
@ -180,7 +180,7 @@ class Rsys {
*/
function check_category($name, $id=0) {
$sql = "SELECT name FROM ".Rsys :: getTable("category")." WHERE LCASE(name)='".strtolower(Database::escape_string($name))."' AND id<>".Database::escape_string($id)."";
WHERE (cu.user_id='".api_get_user_id()."' AND (ir.edit_right=1 OR ir.delete_right=1)) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0)."
if (Rsys :: mysql_datetime_to_timestamp(date('Y-m-d H:i:s')) <= Rsys :: mysql_datetime_to_timestamp($array[1]))
$checked = true;
}
if (!$checked) {
$sql = "DELETE FROM ".Rsys :: getTable("item")." WHERE id =".Database::escape_string($id)."";
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
$sql = "DELETE FROM ".Rsys :: getTable("item_rights")." WHERE item_id =".Database::escape_string($id)."";
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
$sql = "DELETE FROM ".Rsys :: getTable("reservation")." WHERE item_id =".Database::escape_string($id)."";
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
return '0';
} else {
return Database::num_rows($result);
@ -431,7 +431,7 @@ class Rsys {
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE i.id='".Database::escape_string($item_id)."' AND (". (!empty ($x) ? "(cu.user_id='".api_get_user_id()."' AND ".$x.") OR " : '')." i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).")";
$sql .= " LEFT JOIN ".Rsys :: getTable("item_rights")." ir ON ir.item_id=i.id LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id WHERE (cu.user_id='".api_get_user_id()."' AND ir.view_right=1) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0)." ORDER BY ".$orderby;
$sql = "SELECT COUNT(id) FROM ".Database :: get_main_table(TABLE_MAIN_CLASS)." WHERE id NOT IN (SELECT class_id FROM ".Rsys :: getTable("item_rights")." WHERE item_id='".$item_id."') ORDER BY name ASC, code ASC";
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE (cu.user_id='".api_get_user_id()."' AND ir.m_reservation=1 ) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0)." ORDER BY cat.name ASC";
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((cu.user_id='".api_get_user_id()."' AND ir.m_reservation=1 ) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).") AND (category_id =".$category.")
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((cu.user_id='".api_get_user_id()."' AND ir.view_right=1 ) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).") AND (category_id =".$category.")
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE (cu.user_id='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0)." OR 1=".(Rsys :: is_owner_item("$id")? 1 : 0).") AND r.id='".$id."'";
$sql .= " AND (i1.name LIKE '%".$keyword."%' or r1.start_at LIKE '%".$keyword."%' or r1.end_at LIKE '%".$keyword."%' or u.lastname LIKE '%".$keyword."%' or u.firstname LIKE '%".$keyword."%' or s.start_at LIKE '%".$keyword."%' or s.end_at LIKE '%".$keyword."%')";
function get_table_subcribed_reservations($from, $per_page, $column, $direction) {
@ -1260,10 +1260,10 @@ class Rsys {
$sql .= " AND (i1.name LIKE '%".$keyword."%' or c.name LIKE '%".$keyword."%' or r1.start_at LIKE '%".$keyword."%' or r1.end_at LIKE '%".$keyword."%' or u.lastname LIKE '%".$keyword."%' or u.firstname LIKE '%".$keyword."%' or s.start_at LIKE '%".$keyword."%' or s.end_at LIKE '%".$keyword."%')";
}
$sql .= " ORDER BY col".$column." ".$direction." LIMIT ".$from.",".$per_page;
$sql = "SELECT * FROM ".Rsys :: getTable('subscription')." WHERE reservation_id IN (".$ids.") AND (start_at='0000-00-00 00:00:00' OR (start_at<='".$from."' AND end_at>='".$from."') OR (start_at>='".$from."' AND start_at<='".$till."')) ORDER BY start_at ASC";
if ($rarr['reservations'][$array['reservation_id']]['info']['timepicker']) {
@ -1730,7 +1730,7 @@ class Rsys {
FROM ".Rsys :: getTable('reservation')." r
INNER JOIN ".Rsys :: getTable('item')." i ON r.item_id=i.id
WHERE r.id NOT IN (SELECT s.reservation_id FROM ".Rsys :: getTable('subscription')." s WHERE r.id=s.reservation_id AND s.user_id='".api_get_user_id()."') AND i.id='".$item_id."'"; // AND r.subscribe_until <NOW()//TODO:subscribe_untilcontrole
$sql = "SELECT r.*,s.start_at AS tp_start,s.end_at AS tp_end,s.accepted FROM ".Rsys :: getTable('subscription')." s INNER JOIN ".Rsys :: getTable('reservation')." r ON s.reservation_id = r.id WHERE ((r.timepicker=0 AND r.start_at>='".$from."' AND r.end_at<='".$till."') OR (s.start_at>='".$from."' AND s.end_at<='".$till."'))";
$sql="SELECT * from $document_table, $item_property_table WHERE id=ref AND tool = '".TOOL_DOCUMENT."' AND $visibility AND to_group_id = 0 AND to_user_id IS NULL ORDER BY path ASC";
$result=api_sql_query($sql,__FILE__,__LINE__);
$result=Database::query($sql,__FILE__,__LINE__);
while ($row=mysql_fetch_array($result))
{
if (!$folder)
@ -244,7 +244,7 @@ function store_resources($source_type, $source_id)
$result = api_sql_query("SELECT * FROM `$tbl_posts` posts, `$TBL_FORUMS` forum WHERE forum.forum_id=posts.forum_id and post_id=$id",__FILE__,__LINE__);
$result = Database::query("SELECT * FROM `$tbl_posts` posts, `$TBL_FORUMS` forum WHERE forum.forum_id=posts.forum_id and post_id=$id",__FILE__,__LINE__);
$myrow = mysql_fetch_array($result);
// grabbing the title of the post
$sql_title = "SELECT * FROM `$tbl_posts_text` WHERE post_id=".$myrow["post_id"];
$sql="DELETE FROM `$TABLERESOURCE` WHERE source_type='$source_type' and source_id='$source_id' and resource_type='$resource_type' and resource_id='$resource_id'";
api_sql_query($sql,__FILE__,__LINE__);
Database::query($sql,__FILE__,__LINE__);
}
/**
@ -1461,7 +1461,7 @@ function delete_added_resource($type, $id)
$sql = "SELECT * FROM ".$tbl_announcement." a, ".$item_property_table." i WHERE i.tool = '".TOOL_ANNOUNCEMENT."' AND a.id=i.ref AND i.visibility='1' AND i.to_group_id = 0 AND i.to_user_id IS NULL ORDER BY a.display_order ASC";
$sql = "SELECT * FROM ".$tbl_posts." post, ".$tbl_posts_text." post_text WHERE post_text.post_id=post.post_id and post.topic_id=$thread ORDER BY post_text.post_id ASC";
// showing the links that are in the root (having no category)
$sql = "SELECT * FROM ".$link_table.", ".$item_property_table." WHERE (category_id=0 or category_id IS NULL) AND tool = '".TOOL_LINK."' AND id=ref AND visibility='1'";
$sqlcategories = "SELECT * FROM ".$tbl_categories." ORDER by display_order DESC";
$resultcategories = api_sql_query($sqlcategories) or die;
$resultcategories = Database::query($sqlcategories) or die;
while ($myrow = @ mysql_fetch_array($resultcategories))
{
$sql_links = "SELECT * FROM ".$link_table.", ".$item_property_table." WHERE category_id='".$myrow["id"]."' AND tool = '".TOOL_LINK."' AND id=ref AND visibility='1' ORDER BY display_order DESC";
@ -1167,7 +1167,7 @@ if ( isset($_GET['show']) || isset($_POST['personality']))
// selecting the maximum number of pages
$sql = "SELECT * FROM $table_survey_question WHERE type='".Database::escape_string('pagebreak')."' AND survey_id='".Database::escape_string($survey_invitation['survey_id'])."'";
@ -172,7 +172,7 @@ if (api_is_course_admin() || (api_is_course_admin() && $_GET['isStudentView']=='
}
// selecting the maximum number of pages
$sql = "SELECT * FROM $table_survey_question WHERE type='".Database::escape_string('pagebreak')."' AND survey_id='".Database::escape_string($survey_id)."'";
// check if the code doesn't soon exists in this language
$sql = 'SELECT 1 FROM '.$table_survey.' WHERE code="'.Database::escape_string($values['survey_code']).'" AND lang="'.Database::escape_string($values['survey_language']).'"';
$sql = 'SELECT survey_version FROM '.$table_survey.' WHERE parent_id = '.Database::escape_string($values['parent_id']).' ORDER BY survey_version DESC LIMIT 1';
$rs = api_sql_query($sql,__FILE__,__LINE__);
$rs = Database::query($sql,__FILE__,__LINE__);
if(Database::num_rows($rs)===0) {
$sql = 'SELECT survey_version FROM '.$table_survey.' WHERE survey_id = '.Database::escape_string($values['parent_id']);
// check if the code doesn't soon exists in this language
$sql = 'SELECT 1 FROM '.$table_survey.' WHERE code="'.Database::escape_string($values['survey_code']).'" AND lang="'.Database::escape_string($values['survey_language']).'" AND survey_id!='.intval($values['survey_id']);
$sql = 'DELETE FROM '.$table_survey_invitation.' WHERE survey_code = "'.Database::escape_string($datas['code']).'" '.$session_where.' ';
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
$sql = 'DELETE FROM '.$table_survey_answer.' WHERE survey_id='.intval($survey_id);
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
$sql = 'UPDATE '.$table_survey.' SET invited=0, answered=0 WHERE survey_id='.intval($survey_id);
api_sql_query($sql, __FILE__, __LINE__);
Database::query($sql, __FILE__, __LINE__);
return true;
}
@ -529,11 +529,11 @@ class survey_manager
// storing this value in the survey table
$sql = "UPDATE $table_survey SET answered = '".Database::escape_string($number)."' WHERE survey_id = '".Database::escape_string($survey_id)."'";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
// storing that the user has finished the survey.
$sql = "UPDATE $table_survey_invitation SET answered='1' WHERE session_id='".api_get_session_id()."' AND user='".Database::escape_string($user)."' AND survey_code='".Database::escape_string($survey_code)."'";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
}
/**
@ -630,7 +630,7 @@ class survey_manager
// getting the information of the question
$sql = "SELECT * FROM $tbl_survey_question WHERE question_id='".Database::escape_string($question_id)."' ORDER BY `sort`";
while ($row = Database::fetch_array($result,'ASSOC'))
{
@ -968,9 +968,9 @@ class survey_manager
}
$sql1 = "UPDATE $table_survey_question SET sort = '".Database::escape_string($question_sort_two)."' WHERE question_id='".Database::escape_string($question_id_one)."'";
$sql2 = "UPDATE $table_survey_question SET sort = '".Database::escape_string($question_sort_one)."' WHERE question_id='".Database::escape_string($question_id_two)."'";
$sql = "DELETE from $table_survey_question WHERE survey_id='".Database::escape_string($survey_id)."' AND question_id='".Database::escape_string($question_id)."'";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
// deleting the options of the question of the survey
@ -1057,11 +1057,11 @@ class survey_manager
// deleting the survey questions
$sql = "DELETE FROM $table_survey_question WHERE question_id='".Database::escape_string($question_data['shared_question_id'])."'";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
// deleting the options of the question of the survey question
$sql = "DELETE FROM $table_survey_question_option WHERE question_id='".Database::escape_string($question_data['shared_question_id'])."'";
$sql = "DELETE from $table_survey_question_option WHERE survey_id='".Database::escape_string($survey_id)."'";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
return true;
}
@ -1216,7 +1216,7 @@ class survey_manager
// deleting the options of the survey questions
$sql = "DELETE from $table_survey_question_option WHERE survey_id='".Database::escape_string($survey_id)."' AND question_id='".Database::escape_string($question_id)."'";
// update field answered from survey_invitation by user_id and survey_id
$sql = "UPDATE $table_survey_invitation SET answered = '0' WHERE survey_code = (SELECT code FROM $table_survey WHERE survey_id = '".(int)$survey_id."') AND user = '".(int)$user_id."'";
while ($row = Database::fetch_array($result,'ASSOC'))
{
if($row['type'] <> 'pagebreak')
@ -2672,7 +2672,7 @@ class SurveyUtil {
// getting all the answers of the user
$sql = "SELECT * FROM $table_survey_answer WHERE survey_id = '".Database::escape_string($_GET['survey_id'])."' AND user = '".Database::escape_string($_GET['user'])."'";
$sql = "SELECT * FROM $table_survey_question WHERE survey_id='".Database::escape_string($_GET['survey_id'])."' AND type<>'pagebreak' AND type<>'comment' ORDER BY sort ASC LIMIT ".$offset.",1";
$sql = "SELECT count(user) AS total FROM $table_survey_invitation WHERE survey_id='".Database::escape_string($_GET['survey_id'])."' AND session_id='".api_get_session_id()."' ";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
$row = Database::fetch_array($res,'ASSOC');
return $row['total'];
}
@ -4091,7 +4091,7 @@ class SurveyUtil {
}
$sql = "UPDATE $table_survey SET mail_subject='".Database::escape_string($mail_subject)."', $mail_field = '".Database::escape_string($mailtext)."' WHERE survey_id = '".Database::escape_string($_GET['survey_id'])."'";
$sql='SELECT COUNT(*) as count FROM '.$table_survey_answer.' WHERE question_id='.Database::escape_string($all_question_id[$i]['question_id']).' AND user='.api_get_user_id();
$sql2='SELECT COUNT(*) as count FROM '.$table_survey.' s INNER JOIN '.$table_survey_question.' q ON s.survey_id=q.survey_id WHERE s.code="'.$survey_code.'" AND q.type NOT IN("pagebreak","comment")';
$sql3='SELECT COUNT(DISTINCT question_id) as count FROM '.$table_survey_answer.' WHERE survey_id=(SELECT survey_id FROM '.$table_survey.' WHERE code="'.$survey_code.'") AND user="'.$user_answer.'" ';
api_sql_query('UPDATE '.$table_survey_question_group.' SET description = \''.Database::escape_string($_POST['description']).'\' WHERE id = \''.Database::escape_string($_POST['group_id']).'\'');
Database::query('UPDATE '.$table_survey_question_group.' SET description = \''.Database::escape_string($_POST['description']).'\' WHERE id = \''.Database::escape_string($_POST['group_id']).'\'');
$sendmsg = 'GroupUpdatedSuccessfully';
}
elseif(!empty($_POST['name']))
{
api_sql_query('INSERT INTO '.$table_survey_question_group.' (name,description,survey_id) values (\''.Database::escape_string($_POST['name']).'\',\''.Database::escape_string($_POST['description']).'\',\''.Database::escape_string($survey_id).'\') ');
Database::query('INSERT INTO '.$table_survey_question_group.' (name,description,survey_id) values (\''.Database::escape_string($_POST['name']).'\',\''.Database::escape_string($_POST['description']).'\',\''.Database::escape_string($survey_id).'\') ');
api_sql_query('DELETE FROM '.$table_survey_question_group.' WHERE id = '.Database::escape_string($_GET['gid']).' and survey_id = '.Database::escape_string($survey_id));
Database::query('DELETE FROM '.$table_survey_question_group.' WHERE id = '.Database::escape_string($_GET['gid']).' and survey_id = '.Database::escape_string($survey_id));
$sendmsg = 'GroupDeletedSuccessfully';
}
@ -176,7 +176,7 @@ echo ' </tr>';
// Displaying the table contents with all the questions
$question_counter = 1;
$sql = "SELECT * FROM $table_survey_question_group WHERE survey_id = '".Database::escape_string($survey_id)."' ORDER BY id";
$sql = 'SELECT name,description FROM '.$table_survey_question_group.' WHERE id = '.Database::escape_string($_GET['gid']).' AND survey_id = '.Database::escape_string($survey_id).' limit 1';
$sql = "SELECT survey_invitation.*, user.firstname, user.lastname, user.email FROM $table_survey_invitation survey_invitation
LEFT JOIN $table_user user ON survey_invitation.user = user.user_id
WHERE survey_invitation.survey_code = '".Database::escape_string($survey_data['code'])."'";
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
while ($row = mysql_fetch_assoc($res))
{
if (!$_GET['view'] OR $_GET['view'] == 'invited' OR ($_GET['view'] == 'answered' AND in_array($row['user'], $answered_data)) OR ($_GET['view'] == 'unanswered' AND !in_array($row['user'], $answered_data)))
$sql .= " AND (firstname LIKE '%".$keyword."%' OR lastname LIKE '%".$keyword."%' OR email LIKE '%".$keyword."%' OR username LIKE '%".$keyword."%' OR official_code LIKE '%".$keyword."%')";
}
$res = api_sql_query($sql, __FILE__, __LINE__);
$res = Database::query($sql, __FILE__, __LINE__);
$result = Database::num_rows($res);
return $result;
}
@ -375,7 +375,7 @@ function get_user_data($from, $number_of_items, $column, $direction) {
//search for all files that are not deleted => visibility != 2
$query = api_sql_query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$querypath."/%' AND work.filetype='file' AND props.visibility<>'2'",__FILE__,__LINE__);
$query = Database::query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$querypath."/%' AND work.filetype='file' AND props.visibility<>'2'",__FILE__,__LINE__);
//add tem to the zip file
while ($not_deleted_file = mysql_fetch_assoc($query)) { //var_dump($sys_course_path.$_course['path']."/".$not_deleted_file['url']);exit();
//big problem: visible files that are in a hidden folder are included when we do a query for visiblity='v'!!!
//so... I do it in a couple of steps:
//1st: get all files that are visible in the given path
$query = api_sql_query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$querypath."/%' AND work.filetype='file' AND props.visibility='1' AND props.lastedit_user_id='".api_get_user_id()."'",__FILE__,__LINE__);
$query = Database::query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$querypath."/%' AND work.filetype='file' AND props.visibility='1' AND props.lastedit_user_id='".api_get_user_id()."'",__FILE__,__LINE__);
//add them to an array
$all_visible_files_path = array();
while ($all_visible_files = mysql_fetch_assoc($query)) {
//2nd: get all folders that are invisible in the given path
$query2 = api_sql_query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$querypath."/%' AND work.filetype='file' AND props.visibility<>'1' AND props.lastedit_user_id='".api_get_user_id()."'",__FILE__,__LINE__);
$query2 = Database::query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$querypath."/%' AND work.filetype='file' AND props.visibility<>'1' AND props.lastedit_user_id='".api_get_user_id()."'",__FILE__,__LINE__);
//if we get invisible folders, we have to filter out these results from all visible files we found
if (Database::num_rows($query2)>0) {
//add tem to an array
while ($invisible_folders = mysql_fetch_assoc($query2)) {
//3rd: get all files that are in the found invisible folder (these are "invisible" too)
$query3 = api_sql_query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$invisible_folders['path']."/%' AND work.filetype='file' AND props.visibility='1' AND props.lastedit_user_id='".api_get_user_id()."'",__FILE__,__LINE__);
$query3 = Database::query("SELECT url FROM $tbl_student_publication AS work,$prop_table AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work".$invisible_folders['path']."/%' AND work.filetype='file' AND props.visibility='1' AND props.lastedit_user_id='".api_get_user_id()."'",__FILE__,__LINE__);
//add tem to an array
while ($files_in_invisible_folder = mysql_fetch_assoc($query3)) {
api_sql_query('UPDATE '.$work_table.' SET description = '."'".Database::escape_string(Security::remove_XSS($_POST['description']))."'".', qualification = '."'".Database::escape_string($_POST['qualification']['qualification'])."'".' WHERE id = '."'".$row['id']."'",__FILE__,__LINE__);
//api_sql_query('UPDATE '.Database :: get_main_table(TABLE_MAIN_GRADEBOOK_LINK).' SET weight = '."'".Database::escape_string($_POST['qualification']['qualification'])."'".' WHERE course_code = '."'".api_get_course_id()."'".' AND ref_id = '."'".$row['id']."'".'',__FILE__,__LINE__);
Database::query('UPDATE '.$work_table.' SET description = '."'".Database::escape_string(Security::remove_XSS($_POST['description']))."'".', qualification = '."'".Database::escape_string($_POST['qualification']['qualification'])."'".' WHERE id = '."'".$row['id']."'",__FILE__,__LINE__);
//Database::query('UPDATE '.Database :: get_main_table(TABLE_MAIN_GRADEBOOK_LINK).' SET weight = '."'".Database::escape_string($_POST['qualification']['qualification'])."'".' WHERE course_code = '."'".api_get_course_id()."'".' AND ref_id = '."'".$row['id']."'".'',__FILE__,__LINE__);
$sql = "SELECT course_user.user_id FROM $table_user user, $table_course_user course_user
WHERE course_user.user_id=user.user_id AND course_user.course_code='".api_get_course_id()."' AND course_user.status='1'";
$res = api_sql_query($sql,__FILE__,__LINE__);
$res = Database::query($sql,__FILE__,__LINE__);
$admin_course = '';
while($row_admin = Database::fetch_row($res)) {
$admin_course .='\''.$row_admin[0].'\',';
@ -572,12 +572,12 @@ function display_student_publications_list($work_dir,$sub_course_dir,$currentCou
$sql_document = "SELECT count(*) FROM $work_table s, $iprop_table p WHERE s.id = p.ref AND p.tool='work' AND lastedit_user_id IN(".$admin_course.'\''.api_get_user_id().'\''.") AND s.accepted='1' AND url NOT LIKE '".$sub_course_dir.$dir."/%/%' AND url LIKE '".$sub_course_dir.$dir."/%'";
@ -1343,7 +1343,7 @@ function get_work_id($path) {
} else {
$sql = "SELECT id FROM $TBL_STUDENT_PUBLICATION AS work,$TBL_PROP_TABLE AS props WHERE props.tool='work' AND work.id=props.ref AND work.url LIKE 'work/".$path."%' AND work.filetype='file' AND props.visibility<>'2' AND props.lastedit_user_id='".api_get_user_id()."'";
$sql = api_sql_query('SELECT id FROM '.Database::get_course_table(TABLE_STUDENT_PUBLICATION).' WHERE url = '."'/".Database::escape_string($_GET['curdirpath'])."' AND filetype='folder' LIMIT 1");
$sql = Database::query('SELECT id FROM '.Database::get_course_table(TABLE_STUDENT_PUBLICATION).' WHERE url = '."'/".Database::escape_string($_GET['curdirpath'])."' AND filetype='folder' LIMIT 1");
if(Database::num_rows($sql) > 0 ) {
$dir_row = Database::fetch_array($sql);
$parent_id = $dir_row['id'];
@ -854,7 +854,7 @@ if ($ctok==$_POST['sec_token']) { //check the token inserted into the form
Ivan Tcholakov
16 years ago