Ticket #2797: replace addslashes() with explicit escape calls on the DB objects

diff --git a/classes/Queue_item.php b/classes/Queue_item.php
index c7e17be6e84556d56e9e55360e7aed483a274b1d..007d4ed23203464a3df8f79031051f276171333b 100644 (file)
--- a/classes/Queue_item.php
+++ b/classes/Queue_item.php
@@ -32,7 +32,7 @@ class Queue_item extends Memcached_DataObject
         if ($transports) {
             if (is_array($transports)) {
                 // @fixme use safer escaping
-                $list = implode("','", array_map('addslashes', $transports));
+                $list = implode("','", array_map(array($qi, 'escape'), $transports));
                 $qi->whereAdd("transport in ('$list')");
             } else {
                 $qi->transport = $transports;

diff --git a/lib/search_engines.php b/lib/search_engines.php
index 332db3f89a8a25cb2cf08afc8454263c9115250f..19703e03fd81aa983aa710cc7af20242aa32b7a7 100644 (file)
--- a/lib/search_engines.php
+++ b/lib/search_engines.php
@@ -52,10 +52,10 @@ class MySQLSearch extends SearchEngine
     {
         if ('profile' === $this->table) {
             $this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' .
-                                    'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)');
+                                    'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)');
             if (strtolower($q) != $q) {
                 $this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' .
-                                        'AGAINST (\''.addslashes(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR');
+                                        'AGAINST (\''.$this->target->escape(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR');
             }
             return true;
         } else if ('notice' === $this->table) {
@@ -64,13 +64,13 @@ class MySQLSearch extends SearchEngine
             $this->target->whereAdd('notice.is_local != ' . Notice::GATEWAY);
 
             if (strtolower($q) != $q) {
-                $this->target->whereAdd("( MATCH(content) AGAINST ('" . addslashes($q) .
+                $this->target->whereAdd("( MATCH(content) AGAINST ('" . $this->target->escape($q) .
                     "' IN BOOLEAN MODE)) OR ( MATCH(content) " .
-                    "AGAINST ('"  . addslashes(strtolower($q)) .
+                    "AGAINST ('"  . $this->target->escape(strtolower($q)) .
                     "' IN BOOLEAN MODE))");
             } else {
                 $this->target->whereAdd('MATCH(content) ' .
-                                         'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)');
+                                         'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)');
             }
 
             return true;
@@ -89,9 +89,9 @@ class MySQLLikeSearch extends SearchEngine
                            ' fullname LIKE "%%%1$s%%" OR '.
                            ' location LIKE "%%%1$s%%" OR '.
                            ' bio      LIKE "%%%1$s%%" OR '.
-                           ' homepage LIKE "%%%1$s%%")', addslashes($q));
+                           ' homepage LIKE "%%%1$s%%")', $this->target->escape($q, true));
         } else if ('notice' === $this->table) {
-            $qry = sprintf('content LIKE "%%%1$s%%"', addslashes($q));
+            $qry = sprintf('content LIKE "%%%1$s%%"', $this->target->escape($q, true));
         } else {
             throw new ServerException('Unknown table: ' . $this->table);
         }
@@ -107,12 +107,12 @@ class PGSearch extends SearchEngine
     function query($q)
     {
         if ('profile' === $this->table) {
-            return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.addslashes($q).'\')');
+            return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.$this->target->escape($q).'\')');
         } else if ('notice' === $this->table) {
 
             // XXX: We need to filter out gateway notices (notice.is_local = -2) --Zach
 
-            return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.addslashes($q).'\')');
+            return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.$this->target->escape($q).'\')');
         } else {
             throw new ServerException('Unknown table: ' . $this->table);
         }