if (isset($_POST['my_exe_exo_id']) && isset($_POST['student_id'])) {
$sql_lp='SELECT li.id as lp_item_id,li.lp_id,li.item_type,li.path,liv.id AS lp_view_id,liv.user_id,max(liv.view_count) AS view_count FROM '.$TBL_LP_ITEM.' li
INNER JOIN '.$TBL_LP_VIEW.' liv ON li.lp_id=liv.lp_id WHERE li.path="'.Database::escape_string(Security::remove_XSS($_POST['my_exe_exo_id'])).'" AND li.item_type="quiz" AND user_id="'.Database::escape_string(Security::remove_XSS($_POST['student_id'])).'" ';
$sql_lp_view='UPDATE '.$TBL_LP_ITEM_VIEW.' liv SET score ="'.$tot.'" WHERE liv.lp_item_id="'.(int)$row_lp['lp_item_id'].'" AND liv.lp_view_id="'.(int)$row_lp['lp_view_id'].'" AND liv.view_count="'.(int)$row_lp['view_count'].'" ;';
AND lp_view_id = (SELECT id from $TBL_LP_VIEW WHERE user_id = '" . (int) $student_id . "' and lp_id='" . (int) $lp_item_id . "') AND view_count = '$max_view_count'";
AND lp_view_id = (SELECT id from $TBL_LP_VIEW WHERE user_id = '" . (int) $student_id . "' and lp_id='" . (int) $lp_item_id . "') AND view_count = '$max_view_count'";
#$query = "UPDATE $TBL_DOCUMENT SET visibility='$newVisibilityStatus' WHERE path=\"".$file."\""; //added by Toon
#Database::query($query,__FILE__,__LINE__);
#Database::query($query);
//$dialogBox = get_lang('ViMod');
break;
default :
@ -613,13 +613,13 @@ if ($is_allowedToEdit) {
if ($show == 'test') {
$sql = "SELECT id,title,type,active,description, results_disabled FROM $TBL_EXERCICES WHERE active<>'-1' ORDER BY title LIMIT " . (int) $from . "," . (int) ($limitExPage +1);
elseif ($show == 'test') { // only for students //fin
$sql = "SELECT id,title,type,description, results_disabled FROM $TBL_EXERCICES WHERE active='1' ORDER BY title LIMIT " . (int) $from . "," . (int) ($limitExPage +1);
$sql = "SELECT *, quiz_question.question, firstname, lastname FROM $TBL_TRACK_ATTEMPT_RECORDING t,$TBL_USER,$TBL_EXERCICES_QUESTION quiz_question WHERE quiz_question.id = question_id AND user_id = author AND exe_id = '".(int)$_GET['exe_id']."' ORDER BY t.insert_date desc,question ASC";
$sql="SELECT title,description,sound,type,random, random_answers, active, results_disabled, max_attempt,start_time,end_time,feedback_type,expired_time FROM $TBL_EXERCICES WHERE id='".Database::escape_string($id)."'";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
// if the exercise has been found
if($object=Database::fetch_object($result))
@ -96,7 +96,7 @@ class Exercise
$this->start_time = $object->start_time;
$this->expired_time = $object->expired_time;
$sql="SELECT question_id, question_order FROM $TBL_EXERCICE_QUESTION,$TBL_QUESTIONS WHERE question_id=id AND exercice_id='".Database::escape_string($id)."' ORDER BY question_order";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
// fills the array with the question ID for this exercise
// the key of the array is the question position
@ -239,7 +239,7 @@ class Exercise
return false;
}
}
/**
* returns random answers status.
*
@ -247,13 +247,13 @@ class Exercise
*/
function selectRandomAnswers()
{
$this->random_answers;
return $this->random_answers;
}
}
/**
* Same as isRandom() but has a name applied to values different than 0 or 1
*/
@ -399,7 +399,7 @@ class Exercise
{
$this->description=$description;
}
/**
* changes the exercise expired_time
*
@ -410,7 +410,7 @@ class Exercise
{
$this->expired_time = $expired_time;
}
/**
* changes the exercise sound file
*
@ -432,13 +432,13 @@ class Exercise
{
$query="SELECT 1 FROM $TBL_DOCUMENT "
." WHERE path='".str_replace($documentPath,'',$audioPath).'/'.$this->sound."'";
FROM $TBL_EXERCISES AS ce , $TBL_TRACK_EXERCISES AS te, $TBL_USER AS user,$TBL_COURSE_REL_USER AS cuser
@ -141,8 +141,8 @@ class ExerciseResult
FROM $TBL_TRACK_HOTPOTATOES tth, $TBL_USER tu
WHERE tu.user_id=tth.exe_user_id AND tth.exe_cours_id = '" . Database :: escape_string($cid) . " $user_id_and '
ORDER BY tth.exe_cours_id ASC, tth.exe_date ASC";
}
else
{ // get only this user's results
@ -153,7 +153,7 @@ class ExerciseResult
WHERE user.user_id=cuser.user_id AND te.exe_exo_id = ce.id AND te.status != 'incomplete' AND cuser.user_id=te.exe_user_id AND te.exe_cours_id='" . Database :: escape_string($cid) . "'
AND cuser.status<>1 AND te.exe_user_id='".Database::escape_string($user_id)."' $session_id_and AND ce.active <>-1 AND orig_lp_id = 0 AND orig_lp_item_id = 0
AND cuser.course_code=te.exe_cours_id ORDER BY te.exe_cours_id ASC, ce.title ASC, te.exe_date DESC";
$sql_fb_type='SELECT feedback_type, exercises.id FROM '.$TBL_EXERCICES.' as exercises, '.$TBL_TRACK_EXERCICES.' as track_exercises WHERE exercises.id=track_exercises.exe_exo_id AND track_exercises.exe_id="'.Database::escape_string($id).'"';
$queryans = "select * from ".$TBL_TRACK_ATTEMPT." where exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
$queryans = "select * from ".$TBL_TRACK_ATTEMPT." where exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
$queryans = "select answer from ".$TBL_TRACK_ATTEMPT." where exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
$queryfill = "select answer from ".$TBL_TRACK_ATTEMPT." where exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
$queryfill = "SELECT answer FROM ".$TBL_TRACK_ATTEMPT." WHERE exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
while ($real_answer = Database::fetch_array($res_answer)) {
@ -811,7 +811,7 @@ if ($show_results) {
}
$sql_select_answer = 'SELECT id, answer, correct, id_auto FROM '.$table_ans.' WHERE question_id="'.Database::escape_string($questionId).'" AND correct<>0';
$s_user_answer = Database::result($res_user_answer,0,0); // rich - good looking
@ -886,7 +886,7 @@ if ($show_results) {
$i++;
}
$queryfree = "select marks from ".$TBL_TRACK_ATTEMPT." where exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
$sql = "SELECT id, answer, hotspot_coordinates, hotspot_type, ponderation FROM $TBL_ANSWERS WHERE question_id = '".Database::escape_string($questionId)."' ORDER BY id";
$sql = "SELECT id, answer, hotspot_coordinates, hotspot_type FROM $TBL_ANSWERS WHERE question_id = '".Database::escape_string($questionId)."' ORDER BY id";
$sql = "UPDATE `$TBL_ANSWER` SET hotspot_coordinates = '".Database::escape_string($hotspot_coordinates)."',hotspot_type = '".Database::escape_string($hotspot_type)."' WHERE id = '".Database::escape_string($answerId)."' AND question_id ='".Database::escape_string($questionId)."' LIMIT 1 ;";
$sql = "UPDATE $TBL_TRACK_E_HOTSPOT SET coordinate = '".Database::escape_string($coordinates)."' WHERE id ='".Database::escape_string($update_id)."' LIMIT 1 ;;";
WHERE exe_user_id = '".Database::escape_string($my_usr)."' AND exe_cours_id = '".Database::escape_string($my_cid)."' AND exe_exo_id = '".Database::escape_string($my_exe)."'
ORDER BY exe_date DESC";
#echo $sql;
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
if(Database::num_rows($res)>0){
$row = Database::fetch_array($res);
//@todo Check that just summing past score and the new free answer mark doesn't come up
@ -146,7 +146,7 @@ if($action == 'mark'){
$sql = "UPDATE $exercise_table SET exe_result = '$my_score'
WHERE exe_id = '".$row['exe_id']."'";
#echo $sql;
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
$my_msg = get_lang('MarkIsUpdated');
}else{
$my_score = $_POST['score'];
@ -177,12 +177,12 @@ if($action == 'mark'){
# $user_id = '0';
# }
# $sql2 = "update `$tbl_learnpath_user` set score='$score' where (user_id=$user_id and learnpath_id='$learnpath_id' and learnpath_item_id='$learnpath_item_id')";
$sql="INSERT INTO $TBL_EXERCICE_QUESTION (question_id, exercice_id) VALUES('".Database::escape_string($id)."','".Database::escape_string($exerciseId)."')";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
// we do not want to reindex if we had just saved adnd indexed the question
if (!$fromSave) {
$this->search_engine_edit($exerciseId, TRUE);
@ -812,17 +812,17 @@ abstract class Question
unset($this->exerciseList[$pos]);
//update order of other elements
$sql = "SELECT question_order FROM $TBL_EXERCICE_QUESTION WHERE question_id='".Database::escape_string($id)."' AND exercice_id='".Database::escape_string($exerciseId)."'";
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
if (Database::num_rows($res)>0) {
$row = Database::fetch_array($res);
if (!empty($row['question_order'])) {
$sql = "UPDATE $TBL_EXERCICE_QUESTION SET question_order = question_order-1 WHERE exercice_id='".Database::escape_string($exerciseId)."' AND question_order > ".$row['question_order'];
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
}
}
$sql="DELETE FROM $TBL_EXERCICE_QUESTION WHERE question_id='".Database::escape_string($id)."' AND exercice_id='".Database::escape_string($exerciseId)."'";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
return true;
}
@ -850,23 +850,23 @@ abstract class Question
{
//update the question_order of each question to avoid inconsistencies
$sql = "SELECT exercice_id, question_order FROM $TBL_EXERCICE_QUESTION WHERE question_id='".Database::escape_string($id)."'";
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
if (Database::num_rows($res)>0) {
while ($row = Database::fetch_array($res)) {
if (!empty($row['question_order'])) {
$sql = "UPDATE $TBL_EXERCICE_QUESTION SET question_order = question_order-1 WHERE exercice_id='".Database::escape_string($row['exercice_id'])."' AND question_order > ".$row['question_order'];
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
}
}
}
$sql="DELETE FROM $TBL_EXERCICE_QUESTION WHERE question_id='".Database::escape_string($id)."'";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
$sql="DELETE FROM $TBL_QUESTIONS WHERE id='".Database::escape_string($id)."'";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
$sql="DELETE FROM $TBL_REPONSES WHERE question_id='".Database::escape_string($id)."'";
$sql="INSERT INTO $TBL_QUESTIONS(question,description,ponderation,position,type) VALUES('".Database::escape_string($question)."','".Database::escape_string($description)."','".Database::escape_string($weighting)."','".Database::escape_string($position)."','".Database::escape_string($type)."')";
Database::query("INSERT INTO $tbl_courseHome(name,link,image,visibility,admin,address,target) VALUES('".Database::escape_string($name_link)."','".Database::escape_string($link)."','$iconForImportedTools','1','0','$iconForInactiveImportedTools','$target')",__FILE__,__LINE__);
Database::query("INSERT INTO $tbl_courseHome(name,link,image,visibility,admin,address,target) VALUES('".Database::escape_string($name_link)."','".Database::escape_string($link)."','$iconForImportedTools','1','0','$iconForInactiveImportedTools','$target')");
$linkAdded=true;
}
@ -125,7 +125,7 @@ else
$sql = "SELECT name,link,target FROM $tbl_courseHome" .
" WHERE id='" . Database::escape_string($toolid) . "'";
@ -466,7 +466,7 @@ function store_forumcategory($values) {
// find the max cat_order. The new forum category is added at the end => max cat_order + &
$sql="SELECT MAX(cat_order) as sort_max FROM ".Database::escape_string($table_categories);
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
$row=Database::fetch_array($result);
$new_max=$row['sort_max']+1;
$session_id = api_get_session_id();
@ -475,13 +475,13 @@ function store_forumcategory($values) {
if (isset($values['forum_category_id'])) { // storing an edit
$sql="UPDATE ".$table_categories." SET cat_title='".$clean_cat_title."', cat_comment='".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['forum_category_comment'])),COURSEMANAGERLOWSECURITY))."' WHERE cat_id='".Database::escape_string($values['forum_category_id'])."'";
$sql = "UPDATE $table_posts SET post_parent_id=$post_parent_id_of_deleted_post WHERE post_parent_id=$post_id AND thread_id=$thread_id_of_deleted_post AND forum_id=$forum_if_of_deleted_post;";
api_sql_query($sql,__FILE__,__LINE__);
api_sql_query($sql);
$sql="DELETE FROM $table_posts WHERE post_id='".Database::escape_string($post_id)."'"; // note: this has to be a recursive function that deletes all of the posts in this block.
@ -1510,7 +1510,7 @@ function get_post_information($post_id) {
global $table_users;
$sql="SELECT * FROM ".$table_posts."posts, ".$table_users." users WHERE posts.poster_id=users.user_id AND posts.post_id='".Database::escape_string($post_id)."'";
// now have to update the thread table to fill the thread_last_post field (so that we know when the thread has been updated for the last time)
$sql="UPDATE $table_threads SET thread_last_post='".Database::escape_string($last_post_id)."' WHERE thread_id='".Database::escape_string($last_thread_id)."'";
$sql1="SELECT qualify FROM ".$table_threads_qualify." WHERE user_id=".$user_id." and thread_id=".$thread_id.";";
$rs=Database::query($sql1,__FILE__,__LINE__);
$rs=Database::query($sql1);
$row=Database::fetch_array($rs);
$row[1]="update";
return $row;
@ -2095,7 +2095,7 @@ function store_theme_qualify($user_id,$thread_id,$thread_qualify=0,$qualify_user
if ($user_id==strval(intval($user_id)) && $thread_id==strval(intval($thread_id)) && $option==1) {
$sql="SELECT qualify FROM ".$table_threads_qualify." WHERE user_id=".$user_id." and thread_id=".$thread_id.";";
$rs=Database::query($sql,__FILE__,__LINE__);
$rs=Database::query($sql);
$row=Database::fetch_array($rs);
return $row[0];
}
@ -2103,7 +2103,7 @@ function store_theme_qualify($user_id,$thread_id,$thread_qualify=0,$qualify_user
if ($user_id==strval(intval($user_id)) && $option==2) {
$sql="SELECT thread_qualify_max FROM ".$table_threads." WHERE thread_id=".$thread_id.";";
$rs=Database::query($sql,__FILE__,__LINE__);
$rs=Database::query($sql);
$row=Database::fetch_array($rs);
return $row[0];
}
@ -2129,7 +2129,7 @@ function store_theme_qualify($user_id,$thread_id,$thread_qualify=0,$qualify_user
} else {
$sql="SELECT * FROM ".$table_threads_qualify_log." WHERE thread_id='".Database::escape_string($thread_id)."' and user_id='".Database::escape_string($user_id)."' ORDER BY qualify_time DESC";
}
$rs=Database::query($sql,__FILE__,__LINE__);
$rs=Database::query($sql);
while ($row=Database::fetch_array($rs,'ASSOC')) {
$my_qualify_log[]=$row;
}
@ -2162,7 +2162,7 @@ function store_qualify_historical($option,$couser_id,$forum_id,$user_id,$thread_
//extract information of thread_qualify
$sql="SELECT qualify,qualify_time FROM ".$table_threads_qualify." WHERE user_id=".$user_id." and thread_id=".$thread_id.";";
$rs=Database::query($sql,__FILE__,__LINE__);
$rs=Database::query($sql);
$row=Database::fetch_array($rs);
//insert thread_historical
@ -2170,11 +2170,11 @@ function store_qualify_historical($option,$couser_id,$forum_id,$user_id,$thread_
$sql2="UPDATE ".$table_threads_qualify." SET qualify=".$current_qualify.",qualify_time='".$current_date."' WHERE user_id=".$user_id." and thread_id=".$thread_id.";";
Database::query($sql2,__FILE__,__LINE__);
Database::query($sql2);
}
}
/**
@ -2236,7 +2236,7 @@ function store_reply($values) {
WHERE post_id='".Database::escape_string($values['post_id'])."'";
Database::query($sql,__FILE__, __LINE__);
Database::query($sql);
if (!empty($values['remove_attach'])) {
delete_attachment($values['post_id']);
@ -2570,7 +2570,7 @@ function increase_thread_view($thread_id) {
global $table_threads;
$sql="UPDATE $table_threads SET thread_views=thread_views+1 WHERE thread_id='".Database::escape_string($thread_id)."'"; // this needs to be cleaned first
$sql="SELECT * FROM ".$tracking_last_tool_access." WHERE access_user_id='".Database::escape_string($_user['user_id'])."' AND access_cours_code='".Database::escape_string($_course['sysCode'])."' AND access_tool='".Database::escape_string($tool)."'";
$sql="SELECT * FROM".$table_posts."WHERE post_date>'".Database::escape_string($_SESSION['last_forum_access'])."'"; // note: check the performance of this query.
$sql = "SELECT * FROM $table_notification WHERE forum_id = '".Database::escape_string($current_forum['forum_id'])."' OR thread_id = '".Database::escape_string($thread_id)."'";
$sql_delete_mailcue="DELETE FROM $table_mailcue WHERE post_id='".Database::escape_string($id)."' AND thread_id='".Database::escape_string($post_info['thread_id'])."'";
$sql="UPDATE $table_posts SET thread_id='".Database::escape_string($new_thread_id)."', post_parent_id='0' WHERE post_id='".Database::escape_string($values['post_id'])."'";
$result=Database::query($sql,__FILE__, __LINE__);
$result=Database::query($sql);
//echo $sql.'<br/>';
// resetting the parent_id of the thread to 0 for all those who had this moved post as parent
$sql="UPDATE $table_posts SET post_parent_id='0' WHERE post_parent_id='".Database::escape_string($values['post_id'])."'";
$sql="UPDATE $table_threads SET thread_last_post='".$row['post_id']."', thread_replies=thread_replies-1 WHERE thread_id='".Database::escape_string($current_post['thread_id'])."'";
$sql="UPDATE $table_posts SET thread_id='".Database::escape_string($_POST['thread'])."', post_parent_id='0' WHERE post_id='".Database::escape_string($values['post_id'])."'";
@ -3121,12 +3121,12 @@ function store_move_thread($values) {
// change the thread table: setting the forum_id to the new forum
$sql="UPDATE $table_threads SET forum_id='".Database::escape_string($_POST['forum'])."' WHERE thread_id='".Database::escape_string($_POST['thread_id'])."'";
// changing all the posts of the thread: setting the forum_id to the new forum
$sql="UPDATE $table_posts SET forum_id='".Database::escape_string($_POST['forum'])."' WHERE thread_id='".Database::escape_string($_POST['thread_id'])."'";
while ($row3=Database::fetch_array($result3,'ASSOC')) {
if (is_array($forum_list)) {
if (array_key_exists($row3['forum_id'],$forum_list)) {// this is needed because sql3 takes also the deleted forums into account
@ -3589,20 +3589,20 @@ function set_notification($content,$id, $add_only = false) {
// first we check if the notification is already set for this
$sql = "SELECT * FROM $table_notification WHERE $database_field = '".Database::escape_string($id)."' AND user_id = '".Database::escape_string($_user['user_id'])."'";
// if the user did not indicate that (s)he wanted to be notified already then we store the notification request (to prevent double notification requests)
if ($total <= 0) {
$sql = "INSERT INTO $table_notification ($database_field, user_id) VALUES ('".Database::escape_string($id)."','".Database::escape_string($_user['user_id'])."')";
$sql = "DELETE FROM $table_notification WHERE $database_field = '".Database::escape_string($id)."' AND user_id = '".Database::escape_string($_user['user_id'])."'";
$last_post_sql="SELECT post.*, user.firstname, user.lastname FROM $table_posts post, $table_users user WHERE post.poster_id=user.user_id AND visible='1' AND thread_id='".$row['thread_id']."' ORDER BY post_id DESC";
$last_post_sql="SELECT post.*, user.firstname, user.lastname FROM $table_posts post, $table_users user WHERE post.poster_id=user.user_id AND visible='1' AND thread_id='".$row['thread_id']."' ORDER BY post_id DESC";
Ivan Tcholakov
15 years ago