chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fixing early Database::escape_string see BT#9269

Browse Source
1.9.x
Julio Montoya 10 years ago
parent 589e001c90
commit 3463b0465f
1 changed files with 17 additions and 15 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 32
      main/inc/lib/usermanager.lib.php

32
main/inc/lib/usermanager.lib.php
Unescape View File

@ -1530,8 +1530,6 @@ class UserManager
$fvalues = $fvalue;
}
$fvalues = Database::escape_string($fvalues);
$sqluf = "SELECT * FROM $t_uf WHERE field_variable='$fname'";
$resuf = Database::query($sqluf);
$is_extra_file = false;
@ -1546,9 +1544,9 @@ class UserManager
UserManager::process_tags(explode(';', $fvalues), $user_id, $rowuf['id']);
return true;
break;
case self::USER_FIELD_TYPE_SELECT_MULTIPLE :
/*case self::USER_FIELD_TYPE_SELECT_MULTIPLE :
// check code from UserManager::update_user_picture() to use something similar here
break;
break;*/
case self::USER_FIELD_TYPE_RADIO:
case self::USER_FIELD_TYPE_SELECT:
case self::USER_FIELD_TYPE_SELECT_MULTIPLE:
@ -1610,7 +1608,7 @@ class UserManager
$rowufv = Database::fetch_array($resufv);
if ($rowufv['field_value'] != $fvalues) {
$sqlu = "UPDATE $t_ufv SET
field_value = '$fvalues',
field_value = '".Database::escape_string($fvalues)."',
tms = FROM_UNIXTIME($tms)
WHERE id = ".$rowufv['id'];
$resu = Database::query($sqlu);
@ -1624,7 +1622,11 @@ class UserManager
if ($rowufv['field_value'] != $fvalues) {
if ($is_extra_file) {
// To remove from user folder
self::remove_user_extra_file($user_id, $fname, $rowufv['field_value']);
self::remove_user_extra_file(
$user_id,
$fname,
$rowufv['field_value']
);
}
// If the new field is empty, delete it
if ($fvalues == '') {
@ -1633,7 +1635,7 @@ class UserManager
} else {
// Otherwise update it
$sql_query = "UPDATE $t_ufv SET
field_value = '$fvalues',
field_value = '".Database::escape_string($fvalues)."',
tms = FROM_UNIXTIME($tms)
WHERE id = ".$rowufv['id'];
}
@ -1644,10 +1646,10 @@ class UserManager
return true;
} else {
$sqli = "INSERT INTO $t_ufv (user_id,field_id,field_value,tms)
VALUES ( $user_id, ".$rowuf['id'].", '$fvalues', FROM_UNIXTIME($tms))";
$resi = Database::query($sqli);
return ($resi ? true : false);
$sql = "INSERT INTO $t_ufv (user_id,field_id,field_value,tms)
VALUES ( $user_id, ".$rowuf['id'].", '".Database::escape_string($fvalues)."', FROM_UNIXTIME($tms))";
$res = Database::query($sql);
return $res ? true : false;
}
} else {
// Field not found
@ -3491,12 +3493,12 @@ class UserManager
if ($tag_id == 0) {
//the tag doesn't exist
$sql = "INSERT INTO $table_user_tag (tag, field_id,count) VALUES ('$tag','$field_id', count + 1)";
$result = Database::query($sql);
$last_insert_id = Database::get_last_insert_id();
Database::query($sql);
$last_insert_id = Database::insert_id();
} else {
//the tag exists we update it
$sql = "UPDATE $table_user_tag SET count = count + 1 WHERE id = $tag_id";
$result = Database::query($sql);
Database::query($sql);
$last_insert_id = $tag_id;
}
@ -3507,7 +3509,7 @@ class UserManager
//if the relationship does not exist we create it
if (Database::num_rows($result) == 0) {
$sql = "INSERT INTO $table_user_tag_values SET user_id = $user_id, tag_id = $last_insert_id";
$result = Database::query($sql);
Database::query($sql);
}
}
}

Write Preview
Loading…
Cancel
Save