Переглянути джерело

! Adds literal and empty parameters to queries, fixes #645

Signed-off-by: Peter Spicer <[email protected]>
Peter Spicer 10 роки тому
батько
коміт
cd6c86d386

+ 1 - 1
Sources/ManageLanguages.php

@@ -973,7 +973,7 @@ function ModifyLanguage()
 		// Members can no longer use this language.
 		$smcFunc['db_query']('', '
 			UPDATE {db_prefix}members
-			SET lngfile = {string:empty_string}
+			SET lngfile = {empty}
 			WHERE lngfile = {string:current_language}',
 			array(
 				'empty_string' => '',

+ 6 - 0
Sources/Subs-Db-mysql.php

@@ -139,9 +139,15 @@ function smf_db_replacement__callback($matches)
 	if ($matches[1] === 'query_wanna_see_board')
 		return $user_info['query_wanna_see_board'];
 
+	if ($matches[1] === 'empty')
+		return '\'\'';
+
 	if (!isset($matches[2]))
 		smf_db_error_backtrace('Invalid value inserted or no type specified.', '', E_USER_ERROR, __FILE__, __LINE__);
 
+	if ($matches[1] === 'literal')
+		return mysql_real_escape_string($matches[2], $connection);
+
 	if (!isset($values[$matches[2]]))
 		smf_db_error_backtrace('The database value you\'re trying to insert does not exist: ' . htmlspecialchars($matches[2]), '', E_USER_ERROR, __FILE__, __LINE__);
 

+ 6 - 0
Sources/Subs-Db-mysqli.php

@@ -161,9 +161,15 @@ function smf_db_replacement__callback($matches)
 	if ($matches[1] === 'query_wanna_see_board')
 		return $user_info['query_wanna_see_board'];
 
+	if ($matches[1] === 'empty')
+		return '\'\'';
+
 	if (!isset($matches[2]))
 		smf_db_error_backtrace('Invalid value inserted or no type specified.', '', E_USER_ERROR, __FILE__, __LINE__);
 
+	if ($matches[1] === 'literal')
+		return mysqli_real_escape_string($connection, $matches[2]);
+
 	if (!isset($values[$matches[2]]))
 		smf_db_error_backtrace('The database value you\'re trying to insert does not exist: ' . htmlspecialchars($matches[2]), '', E_USER_ERROR, __FILE__, __LINE__);
 

+ 6 - 0
Sources/Subs-Db-postgresql.php

@@ -133,9 +133,15 @@ function smf_db_replacement__callback($matches)
 	if ($matches[1] === 'query_wanna_see_board')
 		return $user_info['query_wanna_see_board'];
 
+	if ($matches[1] === 'empty')
+		return '\'\'';
+
 	if (!isset($matches[2]))
 		smf_db_error_backtrace('Invalid value inserted or no type specified.', '', E_USER_ERROR, __FILE__, __LINE__);
 
+	if ($matches[1] === 'literal')
+		return pg_escape_string($matches[2]);
+
 	if (!isset($values[$matches[2]]))
 		smf_db_error_backtrace('The database value you\'re trying to insert does not exist: ' . htmlspecialchars($matches[2]), '', E_USER_ERROR, __FILE__, __LINE__);
 

+ 6 - 0
Sources/Subs-Db-sqlite.php

@@ -145,9 +145,15 @@ function smf_db_replacement__callback($matches)
 	if ($matches[1] === 'query_wanna_see_board')
 		return $user_info['query_wanna_see_board'];
 
+	if ($matches[1] === 'empty')
+		return '\'\'';
+
 	if (!isset($matches[2]))
 		smf_db_error_backtrace('Invalid value inserted or no type specified.', '', E_USER_ERROR, __FILE__, __LINE__);
 
+	if ($matches[1] === 'literal')
+		return sqlite_escape_string($matches[2]);
+
 	if (!isset($values[$matches[2]]))
 		smf_db_error_backtrace('The database value you\'re trying to insert does not exist: ' . htmlspecialchars($matches[2]), '', E_USER_ERROR, __FILE__, __LINE__);
 

+ 6 - 0
Sources/Subs-Db-sqlite3.php

@@ -176,9 +176,15 @@ function smf_db_replacement__callback($matches)
 	if ($matches[1] === 'query_wanna_see_board')
 		return $user_info['query_wanna_see_board'];
 
+	if ($matches[1] === 'empty')
+		return '\'\'';
+
 	if (!isset($matches[2]))
 		smf_db_error_backtrace('Invalid value inserted or no type specified.', '', E_USER_ERROR, __FILE__, __LINE__);
 
+	if ($matches[1] === 'literal')
+		return SQLite::escapeString($matches[2]);
+
 	if (!isset($values[$matches[2]]))
 		smf_db_error_backtrace('The database value you\'re trying to insert does not exist: ' . htmlspecialchars($matches[2]), '', E_USER_ERROR, __FILE__, __LINE__);