Adding database::escap_string and intvals

main/inc/lib/fileUpload.lib.php

@@ -813,9 +813,12 @@ function filter_extension(&$filename) {
  * @return id if inserted document
  */
 function add_document($_course, $path, $filetype, $filesize, $title, $comment = null, $readonly = 0) {
-	$session_id = api_get_session_id();
-	$readonly = intval($readonly);
-	$comment = Database::escape_string($comment);
+	$session_id    = api_get_session_id();
+	$readonly      = intval($readonly);
+	$comment       = Database::escape_string($comment);
+	$path          = Database::escape_string($path);
+	$filetype      = Database::escape_string($filetype);
+	$filesize      = intval($filesize);
 	
 	$table_document = Database::get_course_table(TABLE_DOCUMENT, $_course['dbName']);
 	$sql = "INSERT INTO $table_document (path, filetype, size, title, comment, readonly, session_id)
@@ -866,6 +869,8 @@ function item_property_update_on_folder($_course, $path, $user_id) {
 	if ($path == '/') {
 		return;
 	}
+	
+	$user_id = intval($user_id);
 
 	// If the given path ends with a / we remove it
 	$endchar = substr($path, strlen($path) - 1, 1);