// Searching for contact URL
if (!is_null($contact_id) && (intval($contact_id) == 0)) {
- $user = dbesc(normalise_link($contact_id));
+ $user = DBA::escape(normalise_link($contact_id));
$url = $user;
$extra_query = "AND `contact`.`nurl` = '%s' ";
if (api_user() !== false) {
// Searching for contact id with uid = 0
if (!is_null($contact_id) && (intval($contact_id) != 0)) {
- $user = dbesc(api_unique_id_to_nurl(intval($contact_id)));
+ $user = DBA::escape(api_unique_id_to_nurl(intval($contact_id)));
if ($user == "") {
throw new BadRequestException("User ID ".$contact_id." not found.");
}
if (is_null($user) && x($_GET, 'user_id')) {
- $user = dbesc(api_unique_id_to_nurl($_GET['user_id']));
+ $user = DBA::escape(api_unique_id_to_nurl($_GET['user_id']));
if ($user == "") {
throw new BadRequestException("User ID ".$_GET['user_id']." not found.");
}
}
if (is_null($user) && x($_GET, 'screen_name')) {
- $user = dbesc($_GET['screen_name']);
+ $user = DBA::escape($_GET['screen_name']);
$extra_query = "AND `contact`.`nick` = '%s' ";
if (api_user() !== false) {
$extra_query .= "AND `contact`.`uid`=".intval(api_user());
}
if (is_null($user) && x($_GET, 'profileurl')) {
- $user = dbesc(normalise_link($_GET['profileurl']));
+ $user = DBA::escape(normalise_link($_GET['profileurl']));
$extra_query = "AND `contact`.`nurl` = '%s' ";
if (api_user() !== false) {
$extra_query .= "AND `contact`.`uid`=".intval(api_user());
list($user, $null) = explode(".", $a->argv[$argid]);
}
if (is_numeric($user)) {
- $user = dbesc(api_unique_id_to_nurl(intval($user)));
+ $user = DBA::escape(api_unique_id_to_nurl(intval($user)));
if ($user != "") {
$url = $user;
}
}
} else {
- $user = dbesc($user);
+ $user = DBA::escape($user);
$extra_query = "AND `contact`.`nick` = '%s' ";
if (api_user() !== false) {
$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
$r = [];
if ($url != "") {
- $r = q("SELECT * FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' LIMIT 1", dbesc(normalise_link($url)));
+ $r = q("SELECT * FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' LIMIT 1", DBA::escape(normalise_link($url)));
}
if (DBA::isResult($r)) {
$userlist = [];
if (x($_GET, 'q')) {
- $r = q("SELECT id FROM `contact` WHERE `uid` = 0 AND `name` = '%s'", dbesc($_GET["q"]));
+ $r = q("SELECT id FROM `contact` WHERE `uid` = 0 AND `name` = '%s'", DBA::escape($_GET["q"]));
if (!DBA::isResult($r)) {
- $r = q("SELECT `id` FROM `contact` WHERE `uid` = 0 AND `nick` = '%s'", dbesc($_GET["q"]));
+ $r = q("SELECT `id` FROM `contact` WHERE `uid` = 0 AND `nick` = '%s'", DBA::escape($_GET["q"]));
}
if (DBA::isResult($r)) {
$r = q(
"SELECT `id`, `nurl`, `network` FROM `contact` WHERE `uid`=%d AND `nick`='%s'",
intval(api_user()),
- dbesc($_POST['screen_name'])
+ DBA::escape($_POST['screen_name'])
);
if (DBA::isResult($r)) {
}
// add parent-uri to sql command if specified by calling app
- $sql_extra = ($parenturi != "" ? " AND `parent-uri` = '" . dbesc($parenturi) . "'" : "");
+ $sql_extra = ($parenturi != "" ? " AND `parent-uri` = '" . DBA::escape($parenturi) . "'" : "");
// get data of the specified message id
$r = q(
// filters
if ($box=="sentbox") {
- $sql_extra = "`mail`.`from-url`='" . dbesc($profile_url) . "'";
+ $sql_extra = "`mail`.`from-url`='" . DBA::escape($profile_url) . "'";
} elseif ($box == "conversation") {
- $sql_extra = "`mail`.`parent-uri`='" . dbesc(defaults($_GET, 'uri', '')) . "'";
+ $sql_extra = "`mail`.`parent-uri`='" . DBA::escape(defaults($_GET, 'uri', '')) . "'";
} elseif ($box == "all") {
$sql_extra = "true";
} elseif ($box == "inbox") {
- $sql_extra = "`mail`.`from-url`!='" . dbesc($profile_url) . "'";
+ $sql_extra = "`mail`.`from-url`!='" . DBA::escape($profile_url) . "'";
}
if ($max_id > 0) {
if ($user_id != "") {
$sql_extra .= ' AND `mail`.`contact-id` = ' . intval($user_id);
} elseif ($screen_name !="") {
- $sql_extra .= " AND `contact`.`nick` = '" . dbesc($screen_name). "'";
+ $sql_extra .= " AND `contact`.`nick` = '" . DBA::escape($screen_name). "'";
}
$r = q(
$r = q(
"SELECT DISTINCT `resource-id` FROM `photo` WHERE `uid` = %d AND `album` = '%s'",
intval(api_user()),
- dbesc($album)
+ DBA::escape($album)
);
if (!DBA::isResult($r)) {
throw new BadRequestException("album not available");
$r = q(
"SELECT `id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' AND `album` = '%s'",
intval(api_user()),
- dbesc($photo_id),
- dbesc($album)
+ DBA::escape($photo_id),
+ DBA::escape($album)
);
if (!DBA::isResult($r)) {
throw new BadRequestException("photo not available");
$sql_extra,
DateTimeFormat::utcNow(), // update edited timestamp
intval(api_user()),
- dbesc($photo_id),
- dbesc($album)
+ DBA::escape($photo_id),
+ DBA::escape($album)
);
} else {
$nothingtodo = true;
$r = q(
"SELECT `id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'",
intval(api_user()),
- dbesc($photo_id)
+ DBA::escape($photo_id)
);
if (!DBA::isResult($r)) {
throw new BadRequestException("photo not available");
FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' %s GROUP BY `resource-id`",
$data_sql,
intval(local_user()),
- dbesc($photo_id),
+ DBA::escape($photo_id),
$scale_sql
);
$r = q(
"SELECT `nick` FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s'",
- dbesc(normalise_link($profile))
+ DBA::escape(normalise_link($profile))
);
if (DBA::isResult($r)) {
if (!$nick == "") {
$r = q(
"SELECT `nick` FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s'",
- dbesc(normalise_link($profile))
+ DBA::escape(normalise_link($profile))
);
if (DBA::isResult($r)) {
"SELECT * FROM `group` WHERE `uid` = %d AND `id` = %d AND `name` = '%s'",
intval($uid),
intval($gid),
- dbesc($name)
+ DBA::escape($name)
);
// error message if specified gid is not in database
if (!DBA::isResult($rname)) {
$rname = q(
"SELECT * FROM `group` WHERE `uid` = %d AND `name` = '%s' AND `deleted` = 0",
intval($uid),
- dbesc($name)
+ DBA::escape($name)
);
// error message if specified group name already exists
if (DBA::isResult($rname)) {
$rname = q(
"SELECT * FROM `group` WHERE `uid` = %d AND `name` = '%s' AND `deleted` = 1",
intval($uid),
- dbesc($name)
+ DBA::escape($name)
);
// error message if specified group name already exists
if (DBA::isResult($rname)) {
$r = q(
"SELECT `mail`.*, `contact`.`nurl` AS `contact-url` FROM `mail`,`contact` WHERE `mail`.`contact-id` = `contact`.`id` AND `mail`.`uid`=%d AND `body` LIKE '%s' ORDER BY `mail`.`id` DESC",
intval($uid),
- dbesc('%'.$searchstring.'%')
+ DBA::escape('%'.$searchstring.'%')
);
$profile_url = $user_info["url"];
intval(NOTIFY_TAGSELF),
intval(NOTIFY_COMMENT),
intval(NOTIFY_SHARE),
- dbesc($params['link']),
+ DBA::escape($params['link']),
intval($params['uid'])
);
if ($p && count($p)) {
$dups = false;
$hash = random_string();
$r = q("SELECT `id` FROM `notify` WHERE `hash` = '%s' LIMIT 1",
- dbesc($hash));
+ DBA::escape($hash));
if (DBA::isResult($r)) {
$dups = true;
}
// create notification entry in DB
q("INSERT INTO `notify` (`hash`, `name`, `url`, `photo`, `date`, `uid`, `link`, `iid`, `parent`, `type`, `verb`, `otype`, `name_cache`)
values('%s', '%s', '%s', '%s', '%s', %d, '%s', %d, %d, %d, '%s', '%s', '%s')",
- dbesc($datarray['hash']),
- dbesc($datarray['name']),
- dbesc($datarray['url']),
- dbesc($datarray['photo']),
- dbesc($datarray['date']),
+ DBA::escape($datarray['hash']),
+ DBA::escape($datarray['name']),
+ DBA::escape($datarray['url']),
+ DBA::escape($datarray['photo']),
+ DBA::escape($datarray['date']),
intval($datarray['uid']),
- dbesc($datarray['link']),
+ DBA::escape($datarray['link']),
intval($datarray['iid']),
intval($datarray['parent']),
intval($datarray['type']),
- dbesc($datarray['verb']),
- dbesc($datarray['otype']),
- dbesc($datarray["name_cache"])
+ DBA::escape($datarray['verb']),
+ DBA::escape($datarray['otype']),
+ DBA::escape($datarray["name_cache"])
);
$r = q("SELECT `id` FROM `notify` WHERE `hash` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($hash),
+ DBA::escape($hash),
intval($params['uid'])
);
if ($r) {
$p = q("SELECT `id` FROM `notify` WHERE `type` IN (%d, %d) AND `link` = '%s' AND `uid` = %d ORDER BY `id`",
intval(NOTIFY_TAGSELF),
intval(NOTIFY_COMMENT),
- dbesc($params['link']),
+ DBA::escape($params['link']),
intval($params['uid'])
);
if ($p && (count($p) > 1)) {
$msg = replace_macros($epreamble, ['$itemlink' => $itemlink]);
$msg_cache = format_notification_message($datarray['name_cache'], strip_tags(BBCode::convert($msg)));
q("UPDATE `notify` SET `msg` = '%s', `msg_cache` = '%s' WHERE `id` = %d AND `uid` = %d",
- dbesc($msg),
- dbesc($msg_cache),
+ DBA::escape($msg),
+ DBA::escape($msg_cache),
intval($notify_id),
intval($params['uid'])
);
FROM `contact`
LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`id` = %d AND `user`.`uid` = %d",
- dbesc($contact["id"]), dbesc($importer["uid"])
+ DBA::escape($contact["id"]), DBA::escape($importer["uid"])
);
if (DBA::isResult($r)) {
logger("Now import the DFRN feed");
)
",
intval($remote_user),
- dbesc($gs),
+ DBA::escape($gs),
intval($remote_user),
- dbesc($gs)
+ DBA::escape($gs)
);
}
}
AND ( `item`.allow_cid REGEXP '<%d>' OR `item`.allow_gid REGEXP '%s' OR ( `item`.allow_cid = '' AND `item`.allow_gid = '')))))
",
intval($remote_user),
- dbesc($gs),
+ DBA::escape($gs),
intval($remote_user),
- dbesc($gs)
+ DBA::escape($gs)
);
}
}
AND NOT `pending` AND NOT `hidden` AND NOT `archive`
AND `network` IN ('%s', '%s', '%s')",
intval($a->profile['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_DIASPORA)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_DIASPORA)
);
if (DBA::isResult($r)) {
$total = intval($r[0]['total']);
AND `network` IN ('%s', '%s', '%s')
ORDER BY RAND() LIMIT %d",
intval($a->profile['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_DIASPORA),
intval($shown)
);
if (DBA::isResult($r)) {
$contacts[] = $contact["id"];
}
$r = q("SELECT `id`, `uid`, `addr`, `url`, `name`, `thumb`, `network` FROM `contact` WHERE `id` IN (%s)",
- dbesc(implode(",", $contacts)));
+ DBA::escape(implode(",", $contacts)));
if (DBA::isResult($r)) {
$contacts = L10n::tt('%d Contact', '%d Contacts', $total);
do {
$guid = System::createGUID(32);
$x = q("SELECT `uid` FROM `user` WHERE `guid` = '%s' LIMIT 1",
- dbesc($guid)
+ DBA::escape($guid)
);
if (!DBA::isResult($x)) {
$found = false;
} else {
$str = preg_quote('<' . str_replace('%', '%%', file_tag_encode($s)) . '>');
}
- return " AND " . (($table) ? dbesc($table) . '.' : '') . "file regexp '" . dbesc($str) . "' ";
+ return " AND " . (($table) ? DBA::escape($table) . '.' : '') . "file regexp '" . DBA::escape($str) . "' ";
}
// ex. given music,video return <music><video> or [music][video]
foreach ($deleted_tags as $key => $tag) {
$r = q("SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d",
- dbesc($tag),
+ DBA::escape($tag),
intval(TERM_OBJ_POST),
intval($termtype),
intval($uid));
Item::update($fields, ['id' => $item_id]);
$r = q("SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d",
- dbesc($file),
+ DBA::escape($file),
intval(TERM_OBJ_POST),
intval($termtype),
intval($uid)
logger("Searching for ".$search." - type ".$type." conversation ".$conv_id, LOGGER_DEBUG);
if ($search != '') {
- $sql_extra = "AND `name` LIKE '%%" . dbesc($search) . "%%'";
- $sql_extra2 = "AND (`attag` LIKE '%%" . dbesc($search) . "%%' OR `name` LIKE '%%" . dbesc($search) . "%%' OR `nick` LIKE '%%" . dbesc($search) . "%%')";
+ $sql_extra = "AND `name` LIKE '%%" . DBA::escape($search) . "%%'";
+ $sql_extra2 = "AND (`attag` LIKE '%%" . DBA::escape($search) . "%%' OR `name` LIKE '%%" . DBA::escape($search) . "%%' OR `nick` LIKE '%%" . DBA::escape($search) . "%%')";
} else {
/// @TODO Avoid these needless else blocks by putting variable-initialization atop of if()
$sql_extra = $sql_extra2 = '';
AND `success_update` >= `failure_update`
AND `network` IN ('%s', '%s') $sql_extra2",
intval(local_user()),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA)
);
$contact_count = (int) $r[0]['c'];
} elseif ($type == 'a') {
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_STATUSNET)
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_STATUSNET)
);
} elseif ($type == 'c') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
- dbesc(NETWORK_STATUSNET)
+ DBA::escape(NETWORK_STATUSNET)
);
} elseif ($type == 'f') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
- dbesc(NETWORK_STATUSNET)
+ DBA::escape(NETWORK_STATUSNET)
);
} elseif ($type == 'm') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr` FROM `contact`
$sql_extra2
ORDER BY `name` ASC ",
intval(local_user()),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA)
);
} elseif ($type == 'a') {
$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
function admin_page_summary(App $a)
{
// are there MyISAM tables in the DB? If so, trigger a warning message
- $r = q("SELECT `engine` FROM `information_schema`.`tables` WHERE `engine` = 'myisam' AND `table_schema` = '%s' LIMIT 1", dbesc(DBA::databaseName()));
+ $r = q("SELECT `engine` FROM `information_schema`.`tables` WHERE `engine` = 'myisam' AND `table_schema` = '%s' LIMIT 1", DBA::escape(DBA::databaseName()));
$showwarning = false;
$warningtext = [];
if (DBA::isResult($r)) {
function update_table($table_name, $fields, $old_url, $new_url)
{
- $dbold = dbesc($old_url);
- $dbnew = dbesc($new_url);
+ $dbold = DBA::escape($old_url);
+ $dbnew = DBA::escape($new_url);
$upd = [];
foreach ($fields as $f) {
$r = q("SELECT `clients`.*
FROM `clients`, `tokens`
WHERE `clients`.`client_id`=`tokens`.`client_id`
- AND `tokens`.`id`='%s' AND `tokens`.`scope`='request'", dbesc($token));
+ AND `tokens`.`id`='%s' AND `tokens`.`scope`='request'", DBA::escape($token));
if (!DBA::isResult($r)) {
return null;
// Now we'll see if we can access the attachment
$r = q("SELECT * FROM `attach` WHERE `id` = '%d' $sql_extra LIMIT 1",
- dbesc($item_id)
+ DBA::escape($item_id)
);
if (!DBA::isResult($r)) {
`ffi_keyword_blacklist` = '%s' WHERE `id` = %d AND `uid` = %d",
intval($profile_id),
intval($priority),
- dbesc($info),
+ DBA::escape($info),
intval($hidden),
intval($notify),
intval($fetch_further_information),
- dbesc($ffi_keyword_blacklist),
+ DBA::escape($ffi_keyword_blacklist),
intval($contact_id),
intval(local_user())
);
$query .= ", ";
}
- $query .= "`" . $key . "` = '" . dbesc($value) . "'";
+ $query .= "`" . $key . "` = '" . DBA::escape($value) . "'";
}
if ($query == "") {
if ($search) {
$searching = true;
$search_hdr = $search;
- $search_txt = dbesc(protect_sprintf(preg_quote($search)));
+ $search_txt = DBA::escape(protect_sprintf(preg_quote($search)));
$sql_extra .= " AND (name REGEXP '$search_txt' OR url REGEXP '$search_txt' OR nick REGEXP '$search_txt') ";
}
if ($nets) {
- $sql_extra .= sprintf(" AND network = '%s' ", dbesc($nets));
+ $sql_extra .= sprintf(" AND network = '%s' ", DBA::escape($nets));
}
$sql_extra2 = ((($sort_type > 0) && ($sort_type <= CONTACT_IS_FRIEND)) ? sprintf(" AND `rel` = %d ", intval($sort_type)) : '');
$r = q("UPDATE `contact` SET `name` = '%s', `nick` = '%s', `url` = '%s', `nurl` = '%s', `request` = '%s', `confirm` = '%s', `notify` = '%s', `poll` = '%s', `attag` = '%s' , `remote_self` = %d
WHERE `id` = %d AND `uid` = %d",
- dbesc($name),
- dbesc($nick),
- dbesc($url),
- dbesc($nurl),
- dbesc($request),
- dbesc($confirm),
- dbesc($notify),
- dbesc($poll),
- dbesc($attag),
+ DBA::escape($name),
+ DBA::escape($nick),
+ DBA::escape($url),
+ DBA::escape($nurl),
+ DBA::escape($request),
+ DBA::escape($confirm),
+ DBA::escape($notify),
+ DBA::escape($poll),
+ DBA::escape($attag),
intval($remote_self),
intval($contact['id']),
local_user()
AND SUBSTRING_INDEX(`nurl`, '/', 3) = '%s'
AND `uid` = %d
AND `network` = '%s' ",
- dbesc(normalise_link(System::baseUrl())),
+ DBA::escape(normalise_link(System::baseUrl())),
intval(local_user()),
- dbesc(NETWORK_DFRN)
+ DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {
$nicknames = [];
foreach ($r as $rr) {
- $nicknames[] = "'" . dbesc(basename($rr['nurl'])) . "'";
+ $nicknames[] = "'" . DBA::escape(basename($rr['nurl'])) . "'";
}
$nicks = implode(',', $nicknames);
AND `uid` = %d
AND `duplex` = 0
LIMIT 1",
- dbesc($dfrn_id),
+ DBA::escape($dfrn_id),
intval($cid),
intval($uid)
);
// Save the private key. Send them the public key.
q("UPDATE `contact` SET `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d",
- dbesc($private_key),
+ DBA::escape($private_key),
intval($contact_id),
intval($uid)
);
// birthday paradox - generate new dfrn-id and fall through.
$new_dfrn_id = random_string();
q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
- dbesc($new_dfrn_id),
+ DBA::escape($new_dfrn_id),
intval($contact_id),
intval($uid)
);
`network` = '%s' WHERE `id` = %d
",
intval($new_relation),
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
intval($duplex),
intval($hidden),
- dbesc(NETWORK_DFRN),
+ DBA::escape(NETWORK_DFRN),
intval($contact_id)
);
} else {
`rel` = %d
WHERE `id` = %d
",
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utcNow()),
- dbesc($addr),
- dbesc($notify),
- dbesc($poll),
- dbesc($network),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape($addr),
+ DBA::escape($notify),
+ DBA::escape($poll),
+ DBA::escape($network),
intval($writable),
intval($hidden),
intval($new_relation),
}
$r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d",
- dbesc($decrypted_dfrn_id),
- dbesc($dfrn_pubkey),
+ DBA::escape($decrypted_dfrn_id),
+ DBA::escape($dfrn_pubkey),
intval($dfrn_record)
);
if (!DBA::isResult($r)) {
`network` = '%s' WHERE `id` = %d
",
intval($new_relation),
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
intval($duplex),
intval($forum),
intval($prv),
- dbesc(NETWORK_DFRN),
+ DBA::escape(NETWORK_DFRN),
intval($dfrn_record)
);
if (!DBA::isResult($r)) { // indicates schema is messed up or total db failure
$sql_extra = '';
switch ($direction) {
case (-1):
- $sql_extra = sprintf(" AND ( `issued-id` = '%s' OR `dfrn-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND ( `issued-id` = '%s' OR `dfrn-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
break;
case 0:
- $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
break;
case 1:
- $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
break;
default:
System::xmlExit(3, 'Invalid direction');
LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0
AND `user`.`nickname` = '%s' AND `user`.`account_expired` = 0 AND `user`.`account_removed` = 0 $sql_extra LIMIT 1",
- dbesc($a->argv[1])
+ DBA::escape($a->argv[1])
);
if (!DBA::isResult($r)) {
$sql_extra = '';
switch($direction) {
case (-1):
- $sql_extra = sprintf(" AND (`issued-id` = '%s' OR `dfrn-id` = '%s') ", dbesc($dfrn_id), dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND (`issued-id` = '%s' OR `dfrn-id` = '%s') ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
- $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
- $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
$r = q("SELECT `contact`.*, `user`.`nickname`, `user`.`page-flags` FROM `contact` LEFT JOIN `user` ON `user`.`uid` = `contact`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0 AND `user`.`nickname` = '%s'
AND `user`.`account_expired` = 0 AND `user`.`account_removed` = 0 $sql_extra LIMIT 1",
- dbesc($a->argv[1])
+ DBA::escape($a->argv[1])
);
if (!DBA::isResult($r)) {
$user = '';
if ($a->argc > 1) {
$r = q("SELECT `hidewall`,`nickname` FROM `user` WHERE `user`.`nickname` = '%s' LIMIT 1",
- dbesc($a->argv[1])
+ DBA::escape($a->argv[1])
);
if (!$r) {
System::httpExit(404);
$sql_extra = '';
switch ($direction) {
case -1:
- $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
- $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
- $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0
AND `user`.`nickname` = '%s' $sql_extra LIMIT 1",
- dbesc($a->argv[1])
+ DBA::escape($a->argv[1])
);
if (DBA::isResult($r)) {
$session_id = session_id();
$expire = time() + 86400;
q("UPDATE `session` SET `expire` = '%s' WHERE `sid` = '%s'",
- dbesc($expire),
- dbesc($session_id)
+ DBA::escape($expire),
+ DBA::escape($session_id)
);
}
}
if ((strlen($challenge)) && (strlen($sec))) {
DBA::delete('profile_check', ["`expire` < ?", time()]);
$r = q("SELECT * FROM `profile_check` WHERE `sec` = '%s' ORDER BY `expire` DESC LIMIT 1",
- dbesc($sec)
+ DBA::escape($sec)
);
if (!DBA::isResult($r)) {
System::xmlExit(3, 'No ticket');
DBA::delete('profile_check', ["`expire` < ?", time()]);
$r = q("SELECT * FROM `profile_check` WHERE `dfrn_id` = '%s' ORDER BY `expire` DESC",
- dbesc($dfrn_id));
+ DBA::escape($dfrn_id));
if (DBA::isResult($r)) {
System::xmlExit(1);
return; // NOTREACHED
DBA::delete('profile_check', ["`expire` < ?", time()]);
$r = q("SELECT * FROM `profile_check` WHERE `sec` = '%s' ORDER BY `expire` DESC LIMIT 1",
- dbesc($sec)
+ DBA::escape($sec)
);
if (!DBA::isResult($r)) {
System::xmlExit(3, 'No ticket');
}
$r = q("SELECT * FROM `challenge` WHERE `dfrn-id` = '%s' AND `challenge` = '%s' LIMIT 1",
- dbesc($dfrn_id),
- dbesc($challenge)
+ DBA::escape($dfrn_id),
+ DBA::escape($challenge)
);
if (!DBA::isResult($r)) {
$sql_extra = '';
switch ($direction) {
case -1:
- $sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
- $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
- $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
if ($type === 'reputation' && strlen($url)) {
$r = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($url),
+ DBA::escape($url),
intval($owner_uid)
);
$reputation = 0;
if ($type !== 'profile') {
$r = q("INSERT INTO `challenge` ( `challenge`, `dfrn-id`, `expire` , `type`, `last_update` )
VALUES( '%s', '%s', '%s', '%s', '%s' ) ",
- dbesc($hash),
- dbesc($dfrn_id),
+ DBA::escape($hash),
+ DBA::escape($dfrn_id),
intval(time() + 60 ),
- dbesc($type),
- dbesc($last_update)
+ DBA::escape($type),
+ DBA::escape($last_update)
);
}
switch ($direction) {
case -1:
if ($type === 'profile') {
- $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id));
} else {
- $sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id));
}
$my_id = $dfrn_id;
break;
case 0:
- $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
- $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0
AND `user`.`nickname` = '%s' $sql_extra LIMIT 1",
- dbesc($nickname)
+ DBA::escape($nickname)
);
if (DBA::isResult($r)) {
$challenge = '';
$session_id = session_id();
$expire = time() + 86400;
q("UPDATE `session` SET `expire` = '%s' WHERE `sid` = '%s'",
- dbesc($expire),
- dbesc($session_id)
+ DBA::escape($expire),
+ DBA::escape($session_id)
);
}
// Lookup the contact based on their URL (which is the only unique thing we have at the moment)
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND NOT `self` LIMIT 1",
intval(local_user()),
- dbesc(normalise_link($dfrn_url))
+ DBA::escape(normalise_link($dfrn_url))
);
if (DBA::isResult($r)) {
VALUES ( %d, '%s', '%s', '%s', '%s', '%s' , '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, %d, %d)",
intval(local_user()),
DateTimeFormat::utcNow(),
- dbesc($dfrn_url),
- dbesc(normalise_link($dfrn_url)),
+ DBA::escape($dfrn_url),
+ DBA::escape(normalise_link($dfrn_url)),
$parms['addr'],
$parms['fn'],
$parms['nick'],
$parms['dfrn-notify'],
$parms['dfrn-poll'],
$parms['dfrn-poco'],
- dbesc(NETWORK_DFRN),
+ DBA::escape(NETWORK_DFRN),
intval($aes_allow),
intval($hidden),
intval($blocked),
$r = q("SELECT `id`, `network` FROM `contact` WHERE `uid` = %d AND `url` = '%s' AND `site-pubkey` = '%s' LIMIT 1",
intval(local_user()),
- dbesc($dfrn_url),
+ DBA::escape($dfrn_url),
$parms['key'] // this was already escaped
);
if (DBA::isResult($r)) {
// Block friend request spam
if ($maxreq) {
$r = q("SELECT * FROM `intro` WHERE `datetime` > '%s' AND `uid` = %d",
- dbesc(DateTimeFormat::utc('now - 24 hours')),
+ DBA::escape(DateTimeFormat::utc('now - 24 hours')),
intval($uid)
);
if (DBA::isResult($r) && count($r) > $maxreq) {
if ($network === NETWORK_DFRN) {
$ret = q("SELECT * FROM `contact` WHERE `uid` = %d AND `url` = '%s' AND `self` = 0 LIMIT 1",
intval($uid),
- dbesc($url)
+ DBA::escape($url)
);
if (DBA::isResult($ret)) {
// There is a contact record but no issued-id, so this
// is a reciprocal introduction from a known contact
$r = q("UPDATE `contact` SET `issued-id` = '%s' WHERE `id` = %d",
- dbesc($issued_id),
+ DBA::escape($issued_id),
intval($contact_record['id'])
);
} else {
`request`, `confirm`, `notify`, `poll`, `poco`, `network`, `blocked`, `pending` )
VALUES ( %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d )",
intval($uid),
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
$parms['url'],
- dbesc(normalise_link($url)),
+ DBA::escape(normalise_link($url)),
$parms['addr'],
$parms['fn'],
$parms['nick'],
$parms['dfrn-notify'],
$parms['dfrn-poll'],
$parms['dfrn-poco'],
- dbesc(NETWORK_DFRN),
+ DBA::escape(NETWORK_DFRN),
intval($blocked),
intval($pending)
);
intval($uid),
intval($contact_record['id']),
((x($_POST,'knowyou') && ($_POST['knowyou'] == 1)) ? 1 : 0),
- dbesc(notags(trim($_POST['dfrn-request-message']))),
- dbesc($hash),
- dbesc(DateTimeFormat::utcNow())
+ DBA::escape(notags(trim($_POST['dfrn-request-message']))),
+ DBA::escape($hash),
+ DBA::escape(DateTimeFormat::utcNow())
);
}
// We could just unblock it, but first we have to jump through a few hoops to
// send an email, or even to find out if we need to send an email.
$intro = q("SELECT * FROM `intro` WHERE `hash` = '%s' LIMIT 1",
- dbesc($_GET['confirm_key'])
+ DBA::escape($_GET['confirm_key'])
);
if (DBA::isResult($intro)) {
// in dfrn_confirm_post()
$r = q("UPDATE `intro` SET `blocked` = 0 WHERE `hash` = '%s'",
- dbesc($_GET['confirm_key'])
+ DBA::escape($_GET['confirm_key'])
);
}
}
}
if ($search) {
- $search = dbesc($search);
+ $search = DBA::escape($search);
$sql_extra = " AND ((`profile`.`name` LIKE '%$search%') OR
(`user`.`nickname` LIKE '%$search%') OR
((`last_contact` >= `last_failure`) OR (`updated` >= `last_failure`)) AND
(`url` LIKE '%s' OR `name` LIKE '%s' OR `location` LIKE '%s' OR
`addr` LIKE '%s' OR `about` LIKE '%s' OR `keywords` LIKE '%s') $extra_sql",
- dbesc(NETWORK_DFRN), dbesc($ostatus), dbesc($diaspora),
- dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)),
- dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)));
+ DBA::escape(NETWORK_DFRN), DBA::escape($ostatus), DBA::escape($diaspora),
+ DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)),
+ DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)));
$results = q("SELECT `nurl`
FROM `gcontact`
`addr` LIKE '%s' OR `about` LIKE '%s' OR `keywords` LIKE '%s') $extra_sql
GROUP BY `nurl`
ORDER BY `updated` DESC LIMIT %d, %d",
- dbesc(NETWORK_DFRN), dbesc($ostatus), dbesc($diaspora),
- dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)),
- dbesc(escape_tags($search2)), dbesc(escape_tags($search2)), dbesc(escape_tags($search2)),
+ DBA::escape(NETWORK_DFRN), DBA::escape($ostatus), DBA::escape($diaspora),
+ DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)),
+ DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)), DBA::escape(escape_tags($search2)),
intval($startrec), intval($perpage));
$j = new stdClass();
$j->total = $count[0]["total"];
if ($a->argc==2) {
$albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s' ",
intval(local_user()),
- dbesc('Contact Photos'),
- dbesc(L10n::t('Contact Photos'))
+ DBA::escape('Contact Photos'),
+ DBA::escape(L10n::t('Contact Photos'))
);
function _map_folder1($el)
$album = "";
if ($a->argc==3) {
$album = hex2bin($a->argv[2]);
- $sql_extra = sprintf("AND `album` = '%s' ", dbesc($album));
+ $sql_extra = sprintf("AND `album` = '%s' ", DBA::escape($album));
$sql_extra2 = "";
$path[]=[$a->argv[2], $album];
}
FROM `photo` WHERE `uid` = %d $sql_extra AND `album` != '%s' AND `album` != '%s'
GROUP BY `resource-id` $sql_extra2",
intval(local_user()),
- dbesc('Contact Photos'),
- dbesc(L10n::t('Contact Photos'))
+ DBA::escape('Contact Photos'),
+ DBA::escape(L10n::t('Contact Photos'))
);
function _map_files1($rr)
// Take the largest picture that is smaller or equal 640 pixels
$p = q("SELECT `scale` FROM `photo` WHERE `resource-id` = '%s' AND `height` <= 640 AND `width` <= 640 ORDER BY `resource-id`, `scale` LIMIT 1",
- dbesc($rr['resource-id']));
+ DBA::escape($rr['resource-id']));
if ($p) {
$scale = $p[0]["scale"];
} else {
$r = q("SELECT `pending` FROM `contact` WHERE `uid` = %d AND ((`rel` != %d) OR (`network` = '%s')) AND
(`nurl` = '%s' OR `alias` = '%s' OR `alias` = '%s') AND
`network` != '%s' LIMIT 1",
- intval(local_user()), dbesc(CONTACT_IS_FOLLOWER), dbesc(NETWORK_DFRN), dbesc(normalise_link($url)),
- dbesc(normalise_link($url)), dbesc($url), dbesc(NETWORK_STATUSNET));
+ intval(local_user()), DBA::escape(CONTACT_IS_FOLLOWER), DBA::escape(NETWORK_DFRN), DBA::escape(normalise_link($url)),
+ DBA::escape(normalise_link($url)), DBA::escape($url), DBA::escape(NETWORK_STATUSNET));
if ($r) {
if ($r[0]['pending']) {
$sql_extra = '';
if (x($a->config, 'admin_nickname')) {
- $sql_extra = sprintf(" AND `nickname` = '%s' ", dbesc(Config::get('config', 'admin_nickname')));
+ $sql_extra = sprintf(" AND `nickname` = '%s' ", DBA::escape(Config::get('config', 'admin_nickname')));
}
if (!empty(Config::get('config', 'admin_email'))) {
$adminlist = explode(",", str_replace(" ", "", Config::get('config', 'admin_email')));
- $r = q("SELECT `username`, `nickname` FROM `user` WHERE `email` = '%s' $sql_extra", dbesc($adminlist[0]));
+ $r = q("SELECT `username`, `nickname` FROM `user` WHERE `email` = '%s' $sql_extra", DBA::escape($adminlist[0]));
$admin = [
'name' => $r[0]['username'],
'profile'=> System::baseUrl() . '/profile/' . $r[0]['nickname'],
VALUES ( %d, %d, '%s','%s','%s','%s','%s','%s')",
intval(local_user()),
intval($contact_id),
- dbesc($r[0]['name']),
- dbesc($r[0]['url']),
- dbesc($r[0]['request']),
- dbesc($r[0]['photo']),
- dbesc($hash),
- dbesc(DateTimeFormat::utcNow())
+ DBA::escape($r[0]['name']),
+ DBA::escape($r[0]['url']),
+ DBA::escape($r[0]['request']),
+ DBA::escape($r[0]['photo']),
+ DBA::escape($hash),
+ DBA::escape(DateTimeFormat::utcNow())
);
$r = q("SELECT `id` FROM `fsuggest` WHERE `note` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($hash),
+ DBA::escape($hash),
intval(local_user())
);
if (DBA::isResult($r)) {
$fsuggest_id = $r[0]['id'];
q("UPDATE `fsuggest` SET `note` = '%s' WHERE `id` = %d AND `uid` = %d",
- dbesc($note),
+ DBA::escape($note),
intval($fsuggest_id),
intval(local_user())
);
$groupname = notags(trim($_POST['groupname']));
if ((strlen($groupname)) && ($groupname != $group['name'])) {
$r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d",
- dbesc($groupname),
+ DBA::escape($groupname),
intval(local_user()),
intval($group['id'])
);
$nmessage = str_replace('$invite_code', $code, $message);
$r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ",
- dbesc($code),
- dbesc(DateTimeFormat::utcNow())
+ DBA::escape($code),
+ DBA::escape(DateTimeFormat::utcNow())
);
if (! is_site_admin()) {
killme();
$r = q("SELECT * FROM `%s` WHERE `id` = %d LIMIT 1",
- dbesc($type),
+ DBA::escape($type),
intval($item_id)
);
if (! DBA::isResult($r)) {
if(count($allowed_groups)) {
$r = q("SELECT `name` FROM `group` WHERE `id` IN ( %s )",
- dbesc(implode(', ', $allowed_groups))
+ DBA::escape(implode(', ', $allowed_groups))
);
if (DBA::isResult($r))
foreach($r as $rr)
}
if(count($allowed_users)) {
$r = q("SELECT `name` FROM `contact` WHERE `id` IN ( %s )",
- dbesc(implode(', ',$allowed_users))
+ DBA::escape(implode(', ',$allowed_users))
);
if (DBA::isResult($r))
foreach($r as $rr)
if(count($deny_groups)) {
$r = q("SELECT `name` FROM `group` WHERE `id` IN ( %s )",
- dbesc(implode(', ', $deny_groups))
+ DBA::escape(implode(', ', $deny_groups))
);
if (DBA::isResult($r))
foreach($r as $rr)
}
if(count($deny_users)) {
$r = q("SELECT `name` FROM `contact` WHERE `id` IN ( %s )",
- dbesc(implode(', ',$deny_users))
+ DBA::escape(implode(', ',$deny_users))
);
if (DBA::isResult($r))
foreach($r as $rr)
// Check if the target user is one of our children
$r = q("SELECT * FROM `user` WHERE `uid` = %d AND `parent-uid` = %d LIMIT 1",
intval($identity),
- dbesc($orig_record['uid'])
+ DBA::escape($orig_record['uid'])
);
// Check if the target user is one of our siblings
if (!DBA::isResult($r) && ($orig_record['parent-uid'] != 0)) {
$r = q("SELECT * FROM `user` WHERE `uid` = %d AND `parent-uid` = %d LIMIT 1",
intval($identity),
- dbesc($orig_record['parent-uid'])
+ DBA::escape($orig_record['parent-uid'])
);
}
//getting additinal information for each identity
foreach ($identities as $key=>$id) {
$thumb = q("SELECT `thumb` FROM `contact` WHERE `uid` = '%s' AND `self` = 1",
- dbesc($id['uid'])
+ DBA::escape($id['uid'])
);
$identities[$key]['thumb'] = $thumb[0]['thumb'];
/**
* @file mod/match.php
*/
+
use Friendica\App;
use Friendica\Content\Widget;
use Friendica\Core\Config;
use Friendica\Core\System;
use Friendica\Database\DBA;
use Friendica\Model\Contact;
-use Friendica\Model\Profile;
use Friendica\Util\Network;
require_once 'include/text.php';
$match = q(
"SELECT `nurl` FROM `contact` WHERE `uid` = '%d' AND nurl='%s' LIMIT 1",
intval(local_user()),
- dbesc($match_nurl)
+ DBA::escape($match_nurl)
);
if (!count($match)) {
if (!DBA::isResult($r)) {
$r = q("SELECT `name`, `url`, `id` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' LIMIT 1",
intval(local_user()),
- dbesc(normalise_link(base64_decode($a->argv[2])))
+ DBA::escape(normalise_link(base64_decode($a->argv[2])))
);
}
if (!DBA::isResult($r)) {
$r = q("SELECT `name`, `url`, `id` FROM `contact` WHERE `uid` = %d AND `addr` = '%s' LIMIT 1",
intval(local_user()),
- dbesc(base64_decode($a->argv[2]))
+ DBA::escape(base64_decode($a->argv[2]))
);
}
$contact_id = $r[0]['contact-id'];
$convid = $r[0]['convid'];
- $sql_extra = sprintf(" and `mail`.`parent-uri` = '%s' ", dbesc($r[0]['parent-uri']));
+ $sql_extra = sprintf(" and `mail`.`parent-uri` = '%s' ", DBA::escape($r[0]['parent-uri']));
if ($convid)
$sql_extra = sprintf(" and ( `mail`.`parent-uri` = '%s' OR `mail`.`convid` = '%d' ) ",
- dbesc($r[0]['parent-uri']),
+ DBA::escape($r[0]['parent-uri']),
intval($convid)
);
}
$r = q("UPDATE `mail` SET `seen` = 1 WHERE `parent-uri` = '%s' AND `uid` = %d",
- dbesc($r[0]['parent-uri']),
+ DBA::escape($r[0]['parent-uri']),
intval(local_user())
);
$nick = $a->argv[1];
$r = q("SELECT `spubkey` FROM `user` WHERE `nickname` = '%s' LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if (! DBA::isResult($r)) {
killme();
$r = q("SELECT COUNT(*) AS `total` FROM `profile` LEFT JOIN `user` ON `user`.`uid` = `profile`.`uid` WHERE `is-default` = 1 AND `user`.`hidewall` = 0 AND MATCH `pub_keywords` AGAINST ('%s') ",
- dbesc($search)
+ DBA::escape($search)
);
if (DBA::isResult($r))
$results = [];
$r = q("SELECT `pub_keywords`, `username`, `nickname`, `user`.`uid` FROM `user` LEFT JOIN `profile` ON `user`.`uid` = `profile`.`uid` WHERE `is-default` = 1 AND `user`.`hidewall` = 0 AND MATCH `pub_keywords` AGAINST ('%s') LIMIT %d , %d ",
- dbesc($search),
+ DBA::escape($search),
intval($startrec),
intval($perpage)
);
$sql_post_table = " INNER JOIN `thread` ON `thread`.`iid` = `item`.`parent`";
}
- $sql_nets = (($nets) ? sprintf(" AND $sql_table.`network` = '%s' ", dbesc($nets)) : '');
- $sql_tag_nets = (($nets) ? sprintf(" AND `item`.`network` = '%s' ", dbesc($nets)) : '');
+ $sql_nets = (($nets) ? sprintf(" AND $sql_table.`network` = '%s' ", DBA::escape($nets)) : '');
+ $sql_tag_nets = (($nets) ? sprintf(" AND `item`.`network` = '%s' ", DBA::escape($nets)) : '');
if ($gid) {
$group = DBA::selectFirst('group', ['name'], ['id' => $gid, 'uid' => local_user()]);
if ($datequery) {
$sql_extra3 .= protect_sprintf(sprintf(" AND $sql_table.created <= '%s' ",
- dbesc(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
+ DBA::escape(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
}
if ($datequery2) {
$sql_extra3 .= protect_sprintf(sprintf(" AND $sql_table.created >= '%s' ",
- dbesc(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
+ DBA::escape(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
}
if ($conv) {
$sql_order = "$sql_table.$ordering";
if (x($_GET, 'offset')) {
- $sql_range = sprintf(" AND $sql_order <= '%s'", dbesc($_GET['offset']));
+ $sql_range = sprintf(" AND $sql_order <= '%s'", DBA::escape($_GET['offset']));
} else {
$sql_range = '';
}
case 'received':
if ($last_received != '') {
$last_date = $last_received;
- $sql_range .= sprintf(" AND $sql_table.`received` < '%s'", dbesc($last_received));
+ $sql_range .= sprintf(" AND $sql_table.`received` < '%s'", DBA::escape($last_received));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
case 'commented':
if ($last_commented != '') {
$last_date = $last_commented;
- $sql_range .= sprintf(" AND $sql_table.`commented` < '%s'", dbesc($last_commented));
+ $sql_range .= sprintf(" AND $sql_table.`commented` < '%s'", DBA::escape($last_commented));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
case 'created':
if ($last_created != '') {
$last_date = $last_created;
- $sql_range .= sprintf(" AND $sql_table.`created` < '%s'", dbesc($last_created));
+ $sql_range .= sprintf(" AND $sql_table.`created` < '%s'", DBA::escape($last_created));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
break;
case 'id':
if (($last_id > 0) && ($sql_table == '`thread`')) {
- $sql_range .= sprintf(" AND $sql_table.`iid` < '%s'", dbesc($last_id));
+ $sql_range .= sprintf(" AND $sql_table.`iid` < '%s'", DBA::escape($last_id));
$a->set_pager_page(1);
$pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage']));
}
$condition = ['unseen' => true, 'uid' => local_user()];
networkSetSeen($condition);
} elseif ($parents_str) {
- $condition = ["`uid` = ? AND `unseen` AND `parent` IN (" . dbesc($parents_str) . ")", local_user()];
+ $condition = ["`uid` = ? AND `unseen` AND `parent` IN (" . DBA::escape($parents_str) . ")", local_user()];
networkSetSeen($condition);
}
$r = q("SELECT COUNT(*) AS `total` FROM `contact` WHERE `uid` = %d AND `self` = 0 AND `blocked` = 0 and `pending` = 0 AND `hidden` = 0 AND `archive` = 0
AND `network` IN ('%s', '%s', '%s', '')",
intval($a->profile['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS)
);
if (DBA::isResult($r)) {
$json_info["contacts"] = intval($r[0]['total']);
AND `blocked` = 0 AND `account_expired` = 0
AND `account_removed` = 0 AND `verified` = 1
LIMIT 1",
- dbesc($authid), dbesc(normalise_openid($authid))
+ DBA::escape($authid), DBA::escape(normalise_openid($authid))
);
if (DBA::isResult($r)) {
// check if the photo exists and get the owner of the photo
$r = q("SELECT `uid` FROM `photo` WHERE `resource-id` = '%s' LIMIT 1",
- dbesc($photo),
+ DBA::escape($photo),
intval($resolution)
);
if (DBA::isResult($r)) {
// Now we'll see if we can access the photo
$r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` <= %d $sql_extra ORDER BY scale DESC LIMIT 1",
- dbesc($photo),
+ DBA::escape($photo),
intval($resolution)
);
if (DBA::isResult($r)) {
if ($a->argc > 1) {
$nick = $a->argv[1];
$user = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `blocked` = 0 LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if (!DBA::isResult($user)) {
}
$r = q("SELECT `album` FROM `photo` WHERE `album` = '%s' AND `uid` = %d",
- dbesc($album),
+ DBA::escape($album),
intval($page_owner_uid)
);
if (!DBA::isResult($r)) {
$newalbum = notags(trim($_POST['albumname']));
if ($newalbum != $album) {
q("UPDATE `photo` SET `album` = '%s' WHERE `album` = '%s' AND `uid` = %d",
- dbesc($newalbum),
- dbesc($album),
+ DBA::escape($newalbum),
+ DBA::escape($album),
intval($page_owner_uid)
);
// Update the photo albums cache
$r = q("SELECT distinct(`resource-id`) as `rid` FROM `photo` WHERE `contact-id` = %d AND `uid` = %d AND `album` = '%s'",
intval($visitor),
intval($page_owner_uid),
- dbesc($album)
+ DBA::escape($album)
);
} else {
$r = q("SELECT distinct(`resource-id`) as `rid` FROM `photo` WHERE `uid` = %d AND `album` = '%s'",
intval(local_user()),
- dbesc($album)
+ DBA::escape($album)
);
}
if (DBA::isResult($r)) {
foreach ($r as $rr) {
- $res[] = "'" . dbesc($rr['rid']) . "'" ;
+ $res[] = "'" . DBA::escape($rr['rid']) . "'" ;
}
} else {
goaway($_SESSION['photo_return']);
$r = q("SELECT `id`, `resource-id` FROM `photo` WHERE `contact-id` = %d AND `uid` = %d AND `resource-id` = '%s' LIMIT 1",
intval($visitor),
intval($page_owner_uid),
- dbesc($a->argv[2])
+ DBA::escape($a->argv[2])
);
} else {
$r = q("SELECT `id`, `resource-id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' LIMIT 1",
intval(local_user()),
- dbesc($a->argv[2])
+ DBA::escape($a->argv[2])
);
}
if (DBA::isResult($r)) {
q("DELETE FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'",
intval($page_owner_uid),
- dbesc($r[0]['resource-id'])
+ DBA::escape($r[0]['resource-id'])
);
Item::deleteForUser(['resource-id' => $r[0]['resource-id'], 'uid' => $page_owner_uid], $page_owner_uid);
logger('rotate');
$r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 0 LIMIT 1",
- dbesc($resource_id),
+ DBA::escape($resource_id),
intval($page_owner_uid)
);
$height = $image->getHeight();
$x = q("UPDATE `photo` SET `data` = '%s', `height` = %d, `width` = %d WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 0",
- dbesc($image->asString()),
+ DBA::escape($image->asString()),
intval($height),
intval($width),
- dbesc($resource_id),
+ DBA::escape($resource_id),
intval($page_owner_uid)
);
$height = $image->getHeight();
$x = q("UPDATE `photo` SET `data` = '%s', `height` = %d, `width` = %d WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 1",
- dbesc($image->asString()),
+ DBA::escape($image->asString()),
intval($height),
intval($width),
- dbesc($resource_id),
+ DBA::escape($resource_id),
intval($page_owner_uid)
);
}
$height = $image->getHeight();
$x = q("UPDATE `photo` SET `data` = '%s', `height` = %d, `width` = %d WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = 2",
- dbesc($image->asString()),
+ DBA::escape($image->asString()),
intval($height),
intval($width),
- dbesc($resource_id),
+ DBA::escape($resource_id),
intval($page_owner_uid)
);
}
}
$p = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d ORDER BY `scale` DESC",
- dbesc($resource_id),
+ DBA::escape($resource_id),
intval($page_owner_uid)
);
if (DBA::isResult($p)) {
$ext = $phototypes[$p[0]['type']];
$r = q("UPDATE `photo` SET `desc` = '%s', `album` = '%s', `allow_cid` = '%s', `allow_gid` = '%s', `deny_cid` = '%s', `deny_gid` = '%s' WHERE `resource-id` = '%s' AND `uid` = %d",
- dbesc($desc),
- dbesc($albname),
- dbesc($str_contact_allow),
- dbesc($str_group_allow),
- dbesc($str_contact_deny),
- dbesc($str_group_deny),
- dbesc($resource_id),
+ DBA::escape($desc),
+ DBA::escape($albname),
+ DBA::escape($str_contact_allow),
+ DBA::escape($str_group_allow),
+ DBA::escape($str_contact_deny),
+ DBA::escape($str_group_deny),
+ DBA::escape($resource_id),
intval($page_owner_uid)
);
//select someone from this user's contacts by name
$r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($newname),
+ DBA::escape($newname),
intval($page_owner_uid)
);
if (!DBA::isResult($r)) {
//select someone by attag or nick and the name passed in
$r = q("SELECT * FROM `contact` WHERE `attag` = '%s' OR `nick` = '%s' AND `uid` = %d ORDER BY `attag` DESC LIMIT 1",
- dbesc($name),
- dbesc($name),
+ DBA::escape($name),
+ DBA::escape($name),
intval($page_owner_uid)
);
}
*/
$r = q("SELECT * FROM `photo` WHERE `album` = '%s' AND `uid` = %d AND `created` > UTC_TIMESTAMP() - INTERVAL 3 HOUR ",
- dbesc($album),
+ DBA::escape($album),
intval($page_owner_uid)
);
$r = q("SELECT `resource-id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` = '%s'
AND `scale` <= 4 $sql_extra GROUP BY `resource-id`",
intval($owner_uid),
- dbesc($album)
+ DBA::escape($album)
);
if (DBA::isResult($r)) {
$a->set_pager_total(count($r));
FROM `photo` WHERE `uid` = %d AND `album` = '%s'
AND `scale` <= 4 $sql_extra GROUP BY `resource-id` ORDER BY `created` $order LIMIT %d , %d",
intval($owner_uid),
- dbesc($album),
+ DBA::escape($album),
intval($a->pager['start']),
intval($a->pager['itemspage'])
);
$ph = q("SELECT * FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'
$sql_extra ORDER BY `scale` ASC ",
intval($owner_uid),
- dbesc($datum)
+ DBA::escape($datum)
);
if (!DBA::isResult($ph)) {
$ph = q("SELECT `id` FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s'
LIMIT 1",
intval($owner_uid),
- dbesc($datum)
+ DBA::escape($datum)
);
if (DBA::isResult($ph)) {
notice(L10n::t('Permission denied. Access to this item may be restricted.'));
$prvnxt = q("SELECT `resource-id` FROM `photo` WHERE `album` = '%s' AND `uid` = %d AND `scale` = 0
$sql_extra ORDER BY `created` $order ",
- dbesc($ph[0]['album']),
+ DBA::escape($ph[0]['album']),
intval($owner_uid)
);
/// @todo Rewrite this query. To do so, $sql_extra must be changed
$linked_items = q("SELECT `id` FROM `item` WHERE `resource-id` = '%s' $sql_extra LIMIT 1",
- dbesc($datum)
+ DBA::escape($datum)
);
$map = null;
$r = q("SELECT `resource-id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s'
$sql_extra GROUP BY `resource-id`",
intval($a->data['user']['uid']),
- dbesc('Contact Photos'),
- dbesc(L10n::t('Contact Photos'))
+ DBA::escape('Contact Photos'),
+ DBA::escape(L10n::t('Contact Photos'))
);
if (DBA::isResult($r)) {
WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s'
$sql_extra GROUP BY `resource-id` ORDER BY `created` DESC LIMIT %d , %d",
intval($a->data['user']['uid']),
- dbesc('Contact Photos'),
- dbesc(L10n::t('Contact Photos')),
+ DBA::escape('Contact Photos'),
+ DBA::escape(L10n::t('Contact Photos')),
intval($a->pager['start']),
intval($a->pager['itemspage'])
);
"SELECT `id`, `from-name`, `from-url`, `from-photo`, `created` FROM `mail`
WHERE `uid` = %d AND `seen` = 0 AND `from-url` != '%s' ",
intval(local_user()),
- dbesc($myurl)
+ DBA::escape($myurl)
);
$mail_count = count($mails);
WHERE `event`.`uid` = %d AND `start` < '%s' AND `finish` > '%s' and `ignore` = 0
ORDER BY `start` ASC ",
intval(local_user()),
- dbesc(DateTimeFormat::utc('now + 7 days')),
- dbesc(DateTimeFormat::utcNow())
+ DBA::escape(DateTimeFormat::utc('now + 7 days')),
+ DBA::escape(DateTimeFormat::utcNow())
);
if (DBA::isResult($ev)) {
Cache::set($cachekey, $ev, CACHE_HOUR);
q(
"UPDATE `notify` SET `name_cache` = '%s', `msg_cache` = '%s' WHERE `id` = %d",
- dbesc($notification["name"]),
- dbesc($notification["message"]),
+ DBA::escape($notification["name"]),
+ DBA::escape($notification["message"]),
intval($notification["id"])
);
}
if (! $system_mode && ! $global) {
$users = q("SELECT `user`.*,`profile`.`hide-friends` from user left join profile on `user`.`uid` = `profile`.`uid`
where `user`.`nickname` = '%s' and `profile`.`is-default` = 1 limit 1",
- dbesc($user)
+ DBA::escape($user)
);
if (! DBA::isResult($users) || $users[0]['hidewall'] || $users[0]['hide-friends']) {
System::httpExit(404);
}
if ($global) {
$contacts = q("SELECT count(*) AS `total` FROM `gcontact` WHERE `updated` >= '%s' AND `updated` >= `last_failure` AND NOT `hide` AND `network` IN ('%s', '%s', '%s')",
- dbesc($update_limit),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS)
+ DBA::escape($update_limit),
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS)
);
} elseif ($system_mode) {
$contacts = q("SELECT count(*) AS `total` FROM `contact` WHERE `self` = 1
AND (`success_update` >= `failure_update` OR `last-item` >= `failure_update`)
AND `network` IN ('%s', '%s', '%s', '%s') $sql_extra",
intval($user['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_STATUSNET)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_STATUSNET)
);
}
if (DBA::isResult($contacts)) {
logger("Start global query", LOGGER_DEBUG);
$contacts = q("SELECT * FROM `gcontact` WHERE `updated` > '%s' AND NOT `hide` AND `network` IN ('%s', '%s', '%s') AND `updated` > `last_failure`
ORDER BY `updated` DESC LIMIT %d, %d",
- dbesc($update_limit),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS),
+ DBA::escape($update_limit),
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS),
intval($startIndex),
intval($itemsPerPage)
);
AND (`success_update` >= `failure_update` OR `last-item` >= `failure_update`)
AND `network` IN ('%s', '%s', '%s', '%s') $sql_extra LIMIT %d, %d",
intval($user['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_STATUSNET),
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_STATUSNET),
intval($startIndex),
intval($itemsPerPage)
);
if (x($category)) {
$sql_post_table = sprintf("INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ",
- dbesc(protect_sprintf($category)), intval(TERM_OBJ_POST), intval(TERM_CATEGORY), intval($a->profile['profile_uid']));
+ DBA::escape(protect_sprintf($category)), intval(TERM_OBJ_POST), intval(TERM_CATEGORY), intval($a->profile['profile_uid']));
}
if (x($hashtags)) {
$sql_post_table .= sprintf("INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ",
- dbesc(protect_sprintf($hashtags)), intval(TERM_OBJ_POST), intval(TERM_HASHTAG), intval($a->profile['profile_uid']));
+ DBA::escape(protect_sprintf($hashtags)), intval(TERM_OBJ_POST), intval(TERM_HASHTAG), intval($a->profile['profile_uid']));
}
if ($datequery) {
- $sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` <= '%s' ", dbesc(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
+ $sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` <= '%s' ", DBA::escape(DateTimeFormat::convert($datequery, 'UTC', date_default_timezone_get()))));
}
if ($datequery2) {
- $sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` >= '%s' ", dbesc(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
+ $sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` >= '%s' ", DBA::escape(DateTimeFormat::convert($datequery2, 'UTC', date_default_timezone_get()))));
}
// Belongs the profile page to a forum?
$srcW = $_POST['xfinal'] - $srcX;
$srcH = $_POST['yfinal'] - $srcY;
- $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = %d LIMIT 1", dbesc($image_id),
- dbesc(local_user()), intval($scale));
+ $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d AND `scale` = %d LIMIT 1", DBA::escape($image_id),
+ DBA::escape(local_user()), intval($scale));
$url = System::baseUrl() . '/profile/' . $a->user['nickname'];
if (DBA::isResult($r)) {
if ($is_default_profile) {
$r = q("UPDATE `photo` SET `profile` = 0 WHERE `profile` = 1 AND `resource-id` != '%s' AND `uid` = %d",
- dbesc($base_image['resource-id']), intval(local_user())
+ DBA::escape($base_image['resource-id']), intval(local_user())
);
} else {
$r = q("update profile set photo = '%s', thumb = '%s' where id = %d and uid = %d",
- dbesc(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-4.' . $Image->getExt()),
- dbesc(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-5.' . $Image->getExt()),
+ DBA::escape(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-4.' . $Image->getExt()),
+ DBA::escape(System::baseUrl() . '/photo/' . $base_image['resource-id'] . '-5.' . $Image->getExt()),
intval($_REQUEST['profile']), intval(local_user())
);
}
$resource_id = $a->argv[2];
//die(":".local_user());
$r = q("SELECT * FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' ORDER BY `scale` ASC", intval(local_user()),
- dbesc($resource_id)
+ DBA::escape($resource_id)
);
if (!DBA::isResult($r)) {
$r = q("UPDATE `photo` SET `profile`=0 WHERE `profile`=1 AND `uid`=%d", intval(local_user()));
$r = q("UPDATE `photo` SET `profile`=1 WHERE `uid` = %d AND `resource-id` = '%s'", intval(local_user()),
- dbesc($resource_id)
+ DBA::escape($resource_id)
);
Contact::updateSelfFromUserID(local_user(), true);
$r2 = q("INSERT INTO `profile` (`uid` , `profile-name` , `name`, `photo`, `thumb`)
VALUES ( %d, '%s', '%s', '%s', '%s' )",
intval(local_user()),
- dbesc($name),
- dbesc($r1[0]['name']),
- dbesc($r1[0]['photo']),
- dbesc($r1[0]['thumb'])
+ DBA::escape($name),
+ DBA::escape($r1[0]['name']),
+ DBA::escape($r1[0]['photo']),
+ DBA::escape($r1[0]['thumb'])
);
$r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
intval(local_user()),
- dbesc($name)
+ DBA::escape($name)
);
info(L10n::t('New profile created.') . EOL);
$r1[0]['is-default'] = 0;
$r1[0]['publish'] = 0;
$r1[0]['net-publish'] = 0;
- $r1[0]['profile-name'] = dbesc($name);
+ $r1[0]['profile-name'] = DBA::escape($name);
DBA::insert('profile', $r1[0]);
$r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
intval(local_user()),
- dbesc($name)
+ DBA::escape($name)
);
info(L10n::t('New profile created.') . EOL);
if ((DBA::isResult($r3)) && (count($r3) == 1)) {
$newname = $lookup;
$r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($newname),
+ DBA::escape($newname),
intval(local_user())
);
if (! DBA::isResult($r)) {
$r = q("SELECT * FROM `contact` WHERE `nick` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($lookup),
+ DBA::escape($lookup),
intval(local_user())
);
}
`education` = '%s',
`hide-friends` = %d
WHERE `id` = %d AND `uid` = %d",
- dbesc($profile_name),
- dbesc($name),
- dbesc($pdesc),
- dbesc($gender),
- dbesc($dob),
- dbesc($address),
- dbesc($locality),
- dbesc($region),
- dbesc($postal_code),
- dbesc($country_name),
- dbesc($marital),
- dbesc($with),
- dbesc($howlong),
- dbesc($sexual),
- dbesc($xmpp),
- dbesc($homepage),
- dbesc($hometown),
- dbesc($politic),
- dbesc($religion),
- dbesc($pub_keywords),
- dbesc($prv_keywords),
- dbesc($likes),
- dbesc($dislikes),
- dbesc($about),
- dbesc($interest),
- dbesc($contact),
- dbesc($music),
- dbesc($book),
- dbesc($tv),
- dbesc($film),
- dbesc($romance),
- dbesc($work),
- dbesc($education),
+ DBA::escape($profile_name),
+ DBA::escape($name),
+ DBA::escape($pdesc),
+ DBA::escape($gender),
+ DBA::escape($dob),
+ DBA::escape($address),
+ DBA::escape($locality),
+ DBA::escape($region),
+ DBA::escape($postal_code),
+ DBA::escape($country_name),
+ DBA::escape($marital),
+ DBA::escape($with),
+ DBA::escape($howlong),
+ DBA::escape($sexual),
+ DBA::escape($xmpp),
+ DBA::escape($homepage),
+ DBA::escape($hometown),
+ DBA::escape($politic),
+ DBA::escape($religion),
+ DBA::escape($pub_keywords),
+ DBA::escape($prv_keywords),
+ DBA::escape($likes),
+ DBA::escape($dislikes),
+ DBA::escape($about),
+ DBA::escape($interest),
+ DBA::escape($contact),
+ DBA::escape($music),
+ DBA::escape($book),
+ DBA::escape($tv),
+ DBA::escape($film),
+ DBA::escape($romance),
+ DBA::escape($work),
+ DBA::escape($education),
intval($hide_friends),
intval($a->argv[1]),
intval(local_user())
if ($is_default) {
if ($namechanged) {
$r = q("UPDATE `user` set `username` = '%s' where `uid` = %d",
- dbesc($name),
+ DBA::escape($name),
intval(local_user())
);
}
if(($a->argc > 2) && intval($a->argv[1]) && intval($a->argv[2])) {
$r = q("SELECT `id` FROM `contact` WHERE `blocked` = 0 AND `pending` = 0 AND `self` = 0
AND `network` = '%s' AND `id` = %d AND `uid` = %d LIMIT 1",
- dbesc(NETWORK_DFRN),
+ DBA::escape(NETWORK_DFRN),
intval($a->argv[2]),
intval(local_user())
);
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `blocked` = 0 and `pending` = 0 and `self` = 0
AND `network` = '%s' ORDER BY `name` ASC",
intval(local_user()),
- dbesc(NETWORK_DFRN)
+ DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {
if (intval(Config::get('config', 'register_policy')) === REGISTER_OPEN) {
if ($using_invites && $invite_id) {
- q("delete * from register where hash = '%s' limit 1", dbesc($invite_id));
+ q("delete * from register where hash = '%s' limit 1", DBA::escape($invite_id));
PConfig::set($user['uid'], 'system', 'invites_remaining', $num_invites);
}
$hash = random_string();
$r = q("INSERT INTO `register` ( `hash`, `created`, `uid`, `password`, `language`, `note` ) VALUES ( '%s', '%s', %d, '%s', '%s', '%s' ) ",
- dbesc($hash),
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape($hash),
+ DBA::escape(DateTimeFormat::utcNow()),
intval($user['uid']),
- dbesc($result['password']),
- dbesc(Config::get('system', 'language')),
- dbesc($_POST['permonlybox'])
+ DBA::escape($result['password']),
+ DBA::escape(Config::get('system', 'language')),
+ DBA::escape($_POST['permonlybox'])
);
// invite system
if ($using_invites && $invite_id) {
- q("DELETE * FROM `register` WHERE `hash` = '%s' LIMIT 1", dbesc($invite_id));
+ q("DELETE * FROM `register` WHERE `hash` = '%s' LIMIT 1", DBA::escape($invite_id));
PConfig::set($user['uid'], 'system', 'invites_remaining', $num_invites);
}
// send email to admins
- $admin_mail_list = "'" . implode("','", array_map("dbesc", explode(",", str_replace(" ", "", Config::get('config', 'admin_email'))))) . "'";
+ $admin_mail_list = "'" . implode("','", array_map(['Friendica\Database\DBA', 'escape'], explode(",", str_replace(" ", "", Config::get('config', 'admin_email'))))) . "'";
$adminlist = q("SELECT uid, language, email FROM user WHERE email IN (%s)",
$admin_mail_list
);
$a = get_app();
$register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1",
- dbesc($hash)
+ DBA::escape($hash)
);
}
$r = q("DELETE FROM `register` WHERE `hash` = '%s'",
- dbesc($register[0]['hash'])
+ DBA::escape($register[0]['hash'])
);
function user_deny($hash)
{
$register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1",
- dbesc($hash)
+ DBA::escape($hash)
);
if (!DBA::isResult($register)) {
$r = q("SELECT COUNT(*) AS `total` FROM `contact` WHERE
`uid` = %d AND `network` = '%s' AND `rel` IN (%d, %d)",
intval($uid),
- dbesc(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_OSTATUS),
intval(CONTACT_IS_FRIEND),
intval(CONTACT_IS_SHARING));
ORDER BY `url`
LIMIT %d, 1",
intval($uid),
- dbesc(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_OSTATUS),
intval(CONTACT_IS_FRIEND),
intval(CONTACT_IS_SHARING), $counter++);
$mentions = (($a->argc > 2 && $a->argv[2] === 'mention') ? true : false);
$r = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `account_expired` = 0 AND `account_removed` = 0 LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if (! DBA::isResult($r)) {
System::httpExit(500);
$r = q("SELECT * FROM `contact` WHERE `network` IN ('%s', '%s')
AND (`nurl` = '%s' OR `alias` = '%s' OR `alias` = '%s')
AND `uid` = %d LIMIT 1",
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_DFRN),
- dbesc(normalise_link($author_link)),
- dbesc($author_link),
- dbesc(normalise_link($author_link)),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(normalise_link($author_link)),
+ DBA::escape($author_link),
+ DBA::escape(normalise_link($author_link)),
intval($importer['uid'])
);
if (! DBA::isResult($r)) {
if($result['success']) {
$r = q("SELECT * FROM `contact` WHERE `network` = '%s' AND ( `url` = '%s' OR `alias` = '%s')
AND `uid` = %d LIMIT 1",
- dbesc(NETWORK_OSTATUS),
- dbesc($author_link),
- dbesc($author_link),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape($author_link),
+ DBA::escape($author_link),
intval($importer['uid'])
);
}
if (x($_GET,'save') && $search) {
$r = q("SELECT * FROM `search` WHERE `uid` = %d AND `term` = '%s' LIMIT 1",
intval(local_user()),
- dbesc($search)
+ DBA::escape($search)
);
if (!DBA::isResult($r)) {
DBA::insert('search', ['uid' => local_user(), 'term' => $search]);
icon='%s',
uid=%d
WHERE client_id='%s'",
- dbesc($key),
- dbesc($secret),
- dbesc($name),
- dbesc($redirect),
- dbesc($icon),
+ DBA::escape($key),
+ DBA::escape($secret),
+ DBA::escape($name),
+ DBA::escape($redirect),
+ DBA::escape($icon),
local_user(),
- dbesc($key)
+ DBA::escape($key)
);
} else {
q("INSERT INTO clients
(client_id, pw, name, redirect_uri, icon, uid)
VALUES ('%s', '%s', '%s', '%s', '%s',%d)",
- dbesc($key),
- dbesc($secret),
- dbesc($name),
- dbesc($redirect),
- dbesc($icon),
+ DBA::escape($key),
+ DBA::escape($secret),
+ DBA::escape($name),
+ DBA::escape($redirect),
+ DBA::escape($icon),
local_user()
);
}
$r = q("UPDATE `mailacct` SET `server` = '%s', `port` = %d, `ssltype` = '%s', `user` = '%s',
`action` = %d, `movetofolder` = '%s',
`mailbox` = 'INBOX', `reply_to` = '%s', `pubmail` = %d WHERE `uid` = %d",
- dbesc($mail_server),
+ DBA::escape($mail_server),
intval($mail_port),
- dbesc($mail_ssl),
- dbesc($mail_user),
+ DBA::escape($mail_ssl),
+ DBA::escape($mail_user),
intval($mail_action),
- dbesc($mail_movetofolder),
- dbesc($mail_replyto),
+ DBA::escape($mail_movetofolder),
+ DBA::escape($mail_replyto),
intval($mail_pubmail),
intval(local_user())
);
Theme::install($theme);
$r = q("UPDATE `user` SET `theme` = '%s' WHERE `uid` = %d",
- dbesc($theme),
+ DBA::escape($theme),
intval(local_user())
);
`def_gid` = %d, `blockwall` = %d, `hidewall` = %d, `blocktags` = %d,
`unkmail` = %d, `cntunkmail` = %d, `language` = '%s'
WHERE `uid` = %d",
- dbesc($username),
- dbesc($email),
- dbesc($openid),
- dbesc($timezone),
- dbesc($str_contact_allow),
- dbesc($str_group_allow),
- dbesc($str_contact_deny),
- dbesc($str_group_deny),
+ DBA::escape($username),
+ DBA::escape($email),
+ DBA::escape($openid),
+ DBA::escape($timezone),
+ DBA::escape($str_contact_allow),
+ DBA::escape($str_group_allow),
+ DBA::escape($str_contact_deny),
+ DBA::escape($str_group_deny),
intval($notify),
intval($page_flags),
intval($account_type),
- dbesc($defloc),
+ DBA::escape($defloc),
intval($allow_location),
intval($maxreq),
intval($expire),
- dbesc($openidserver),
+ DBA::escape($openidserver),
intval($def_gid),
intval($blockwall),
intval($hidewall),
intval($blocktags),
intval($unkmail),
intval($cntunkmail),
- dbesc($language),
+ DBA::escape($language),
intval(local_user())
);
if (DBA::isResult($r)) {
`hide-friends` = %d
WHERE `is-default` = 1 AND `uid` = %d",
intval($publish),
- dbesc($username),
+ DBA::escape($username),
intval($net_publish),
intval($hide_friends),
intval(local_user())
if (($a->argc > 3) && ($a->argv[2] === 'edit')) {
$r = q("SELECT * FROM clients WHERE client_id='%s' AND uid=%d",
- dbesc($a->argv[3]),
+ DBA::escape($a->argv[3]),
local_user());
if (!DBA::isResult($r)) {
$t = q("SELECT count(tid) as tcount FROM term WHERE oid=%d AND term='%s'",
intval($item['id']),
- dbesc($term)
+ DBA::escape($term)
);
if (!$blocktags && $t[0]['tcount'] == 0) {
intval($item['id']),
$term_objtype,
TERM_HASHTAG,
- dbesc($term),
- dbesc(System::baseUrl() . '/search?tag=' . $term),
+ DBA::escape($term),
+ DBA::escape(System::baseUrl() . '/search?tag=' . $term),
intval($owner_uid)
);
}
);
$t = q("SELECT COUNT(`tid`) AS `tcount` FROM `term` WHERE `oid`=%d AND `term`='%s'",
intval($original_item['id']),
- dbesc($term)
+ DBA::escape($term)
);
if (DBA::isResult($x) && !$x[0]['blocktags'] && $t[0]['tcount'] == 0){
intval($original_item['id']),
$term_objtype,
TERM_HASHTAG,
- dbesc($term),
- dbesc(System::baseUrl() . '/search?tag=' . $term),
+ DBA::escape($term),
+ DBA::escape(System::baseUrl() . '/search?tag=' . $term),
intval($owner_uid)
);
}
use Friendica\Core\Config;
use Friendica\Core\L10n;
use Friendica\Core\System;
-use Friendica\Core\Worker;
use Friendica\Database\DBA;
use Friendica\Model\Contact;
use Friendica\Model\Group;
use Friendica\Model\Item;
use Friendica\Model\Profile;
-use Friendica\Model\Term;
use Friendica\Protocol\DFRN;
-use Friendica\Util\DateTimeFormat;
require_once 'include/items.php';
require_once 'include/security.php';
if($a->argc > 1) {
$nick = $a->argv[1];
$user = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `blocked` = 0 LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if(! count($user))
$r = q("SELECT `id` FROM `attach` WHERE `uid` = %d AND `id` = '%s' LIMIT 1",
intval(local_user()),
- dbesc($video_id)
+ DBA::escape($video_id)
);
if (DBA::isResult($r)) {
q("DELETE FROM `attach` WHERE `uid` = %d AND `id` = '%s'",
intval(local_user()),
- dbesc($video_id)
+ DBA::escape($video_id)
);
$i = q("SELECT `id` FROM `item` WHERE `attach` like '%%attach/%s%%' AND `uid` = %d LIMIT 1",
- dbesc($video_id),
+ DBA::escape($video_id),
intval(local_user())
);
if ($a->argc > 1) {
$nick = $a->argv[1];
$r = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `blocked` = 0 LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if (! DBA::isResult($r)) {
AND NOT `hidden` AND NOT `archive`
AND `network` IN ('%s', '%s', '%s')",
intval($a->profile['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS)
);
if (DBA::isResult($r)) {
$a->set_pager_total($r[0]['total']);
AND `network` IN ('%s', '%s', '%s')
ORDER BY `name` ASC LIMIT %d, %d",
intval($a->profile['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS),
intval($a->pager['start']),
intval($a->pager['itemspage'])
);
if($a->argc > 1) {
$nick = $a->argv[1];
$r = q("SELECT `user`.*, `contact`.`id` FROM `user` LEFT JOIN `contact` on `user`.`uid` = `contact`.`uid` WHERE `user`.`nickname` = '%s' AND `user`.`blocked` = 0 and `contact`.`self` = 1 LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if (! DBA::isResult($r)) {
if ($r_json) {
$r = q("SELECT `id` FROM `attach` WHERE `uid` = %d AND `created` = '%s' AND `hash` = '%s' LIMIT 1",
intval($page_owner_uid),
- dbesc($created),
- dbesc($hash)
+ DBA::escape($created),
+ DBA::escape($hash)
);
if (! DBA::isResult($r)) {
INNER JOIN `contact` on `user`.`uid` = `contact`.`uid`
WHERE `user`.`nickname` = '%s' AND `user`.`blocked` = 0
AND `contact`.`self` = 1 LIMIT 1",
- dbesc($nick)
+ DBA::escape($nick)
);
if (!DBA::isResult($r)) {
INNER JOIN `contact` on `user`.`uid` = `contact`.`uid`
WHERE `user`.`nickname` = '%s' AND `user`.`blocked` = 0
AND `contact`.`self` = 1 LIMIT 1",
- dbesc($user_info['screen_name'])
+ DBA::escape($user_info['screen_name'])
);
}
} else {
}
$r = q("select * from user where nickname = '%s' limit 1",
- dbesc($recipient)
+ DBA::escape($recipient)
);
if (! DBA::isResult($r)) {
}
$r = q("select * from user where nickname = '%s' limit 1",
- dbesc($recipient)
+ DBA::escape($recipient)
);
if (! DBA::isResult($r)) {
if (!empty($x['networks'])) {
/// @TODO rewrite to foreach()
array_walk($x['networks'], function (&$value) {
- $value = "'" . dbesc($value) . "'";
+ $value = "'" . DBA::escape($value) . "'";
});
$str_nets = implode(',', $x['networks']);
$sql_extra .= " AND `network` IN ( $str_nets ) ";
$filter_str = [];
$filter_sql = "";
foreach ($filter as $column => $value) {
- $filter_str[] = sprintf("`%s` = '%s'", $column, dbesc($value));
+ $filter_str[] = sprintf("`%s` = '%s'", $column, DBA::escape($value));
}
if (count($filter_str) > 0) {
$filter_sql = "AND " . implode(" AND ", $filter_str);
return q(
"UPDATE `notify` SET `seen` = %d WHERE (`link` = '%s' OR (`parent` != 0 AND `parent` = %d AND `otype` = '%s')) AND `uid` = %d",
intval($seen),
- dbesc($note['link']),
+ DBA::escape($note['link']),
intval($note['parent']),
- dbesc($note['otype']),
+ DBA::escape($note['otype']),
intval(local_user())
);
}
*/
private static function checkCols($table, &$arr)
{
- $query = sprintf("SHOW COLUMNS IN `%s`", dbesc($table));
+ $query = sprintf("SHOW COLUMNS IN `%s`", DBA::escape($table));
logger("uimport: $query", LOGGER_DEBUG);
$r = q($query);
$tcols = [];
}
self::checkCols($table, $arr);
- $cols = implode("`,`", array_map('dbesc', array_keys($arr)));
- $vals = implode("','", array_map('dbesc', array_values($arr)));
+ $cols = implode("`,`", array_map(['Friendica\Database\DBA', 'escape'], array_keys($arr)));
+ $vals = implode("','", array_map(['Friendica\Database\DBA', 'escape'], array_values($arr)));
$query = "INSERT INTO `$table` (`$cols`) VALUES ('$vals')";
logger("uimport: $query", LOGGER_TRACE);
if (is_bool($value)) {
$value = ($value ? '1' : '0');
} else {
- $value = dbesc($value);
+ $value = self::escape($value);
}
return;
}
} elseif (is_float($value) || is_integer($value)) {
$value = (string) $value;
} else {
- $value = "'" . dbesc($value) . "'";
+ $value = "'" . self::escape($value) . "'";
}
}
*/
public static function convertToInnoDB() {
$r = q("SELECT `TABLE_NAME` FROM `information_schema`.`tables` WHERE `engine` = 'MyISAM' AND `table_schema` = '%s'",
- dbesc(DBA::databaseName()));
+ DBA::escape(DBA::databaseName()));
if (!DBA::isResult($r)) {
echo L10n::t('There are no tables on MyISAM.')."\n";
}
foreach ($r AS $table) {
- $sql = sprintf("ALTER TABLE `%s` engine=InnoDB;", dbesc($table['TABLE_NAME']));
+ $sql = sprintf("ALTER TABLE `%s` engine=InnoDB;", DBA::escape($table['TABLE_NAME']));
echo $sql."\n";
$result = DBA::e($sql);
$a = get_app();
//send the administrators an e-mail
- $admin_mail_list = "'".implode("','", array_map('dbesc', explode(",", str_replace(" ", "", Config::get('config', 'admin_email')))))."'";
+ $admin_mail_list = "'".implode("','", array_map(['Friendica\Database\DBA', 'escape'], explode(",", str_replace(" ", "", Config::get('config', 'admin_email')))))."'";
$adminlist = q("SELECT uid, language, email FROM user WHERE email IN (%s)",
$admin_mail_list
);
if (isset($database[$name]["table_status"]["Comment"])) {
if ($database[$name]["table_status"]["Comment"] != $structure['comment']) {
- $sql2 = "COMMENT = '".dbesc($structure['comment'])."'";
+ $sql2 = "COMMENT = '".DBA::escape($structure['comment'])."'";
if ($sql3 == "") {
$sql3 = "ALTER" . $ignore . " TABLE `".$temp_name."` ".$sql2;
if (isset($database[$name]["table_status"]["Engine"]) && isset($structure['engine'])) {
if ($database[$name]["table_status"]["Engine"] != $structure['engine']) {
- $sql2 = "ENGINE = '".dbesc($structure['engine'])."'";
+ $sql2 = "ENGINE = '".DBA::escape($structure['engine'])."'";
if ($sql3 == "") {
$sql3 = "ALTER" . $ignore . " TABLE `".$temp_name."` ".$sql2;
}
if (isset($parameters["comment"])) {
- $fieldstruct .= " COMMENT '".dbesc($parameters["comment"])."'";
+ $fieldstruct .= " COMMENT '".DBA::escape($parameters["comment"])."'";
}
/*if (($parameters["primary"] != "") && $create)
$sql_rows = [];
$primary_keys = [];
foreach ($structure["fields"] AS $fieldname => $field) {
- $sql_rows[] = "`".dbesc($fieldname)."` ".self::FieldCommand($field);
+ $sql_rows[] = "`".DBA::escape($fieldname)."` ".self::FieldCommand($field);
if (x($field,'primary') && $field['primary']!='') {
$primary_keys[] = $fieldname;
}
}
if (isset($structure["comment"])) {
- $comment = " COMMENT='" . dbesc($structure["comment"]) . "'";
+ $comment = " COMMENT='" . DBA::escape($structure["comment"]) . "'";
}
$sql = implode(",\n\t", $sql_rows);
- $sql = sprintf("CREATE TABLE IF NOT EXISTS `%s` (\n\t", dbesc($name)).$sql.
+ $sql = sprintf("CREATE TABLE IF NOT EXISTS `%s` (\n\t", DBA::escape($name)).$sql.
"\n)" . $engine . " DEFAULT COLLATE utf8mb4_general_ci" . $comment;
if ($verbose) {
echo $sql.";\n";
}
private static function addTableField($fieldname, $parameters) {
- $sql = sprintf("ADD `%s` %s", dbesc($fieldname), self::FieldCommand($parameters));
+ $sql = sprintf("ADD `%s` %s", DBA::escape($fieldname), self::FieldCommand($parameters));
return($sql);
}
private static function modifyTableField($fieldname, $parameters) {
- $sql = sprintf("MODIFY `%s` %s", dbesc($fieldname), self::FieldCommand($parameters, false));
+ $sql = sprintf("MODIFY `%s` %s", DBA::escape($fieldname), self::FieldCommand($parameters, false));
return($sql);
}
private static function dropIndex($indexname) {
- $sql = sprintf("DROP INDEX `%s`", dbesc($indexname));
+ $sql = sprintf("DROP INDEX `%s`", DBA::escape($indexname));
return($sql);
}
}
if (preg_match('|(.+)\((\d+)\)|', $fieldname, $matches)) {
- $names .= "`".dbesc($matches[1])."`(".intval($matches[2]).")";
+ $names .= "`".DBA::escape($matches[1])."`(".intval($matches[2]).")";
} else {
- $names .= "`".dbesc($fieldname)."`";
+ $names .= "`".DBA::escape($fieldname)."`";
}
}
}
- $sql = sprintf("%s INDEX `%s` (%s)", $method, dbesc($indexname), $names);
+ $sql = sprintf("%s INDEX `%s` (%s)", $method, DBA::escape($indexname), $names);
return($sql);
}
}
if (preg_match('|(.+)\((\d+)\)|', $fieldname, $matches)) {
- $names .= "`".dbesc($matches[1])."`";
+ $names .= "`".DBA::escape($matches[1])."`";
} else {
- $names .= "`".dbesc($fieldname)."`";
+ $names .= "`".DBA::escape($fieldname)."`";
}
}
$r = q($query1.$query2.$query3." ORDER BY `item`.`id` LIMIT 1",
intval($start_id), intval($end_id),
- dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS));
+ DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA), DBA::escape(NETWORK_OSTATUS));
if (!$r) {
Config::set("system", "post_update_version", 1194);
logger("Update is done", LOGGER_DEBUG);
$r = q($query1.$query2.$query3." ORDER BY `item`.`id` LIMIT 1000,1",
intval($start_id), intval($end_id),
- dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS));
+ DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA), DBA::escape(NETWORK_OSTATUS));
if ($r) {
$pos_id = $r[0]["id"];
} else {
q("UPDATE `item` ".$query2." SET `item`.`global` = 1 ".$query3,
intval($start_id), intval($pos_id),
- dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS));
+ DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA), DBA::escape(NETWORK_OSTATUS));
logger("Done", LOGGER_DEBUG);
}
$r = q("SELECT `id`, `id` AS `cid`, 0 AS `gid`, 0 AS `zid`, `uid`, `url`, `nurl`, `alias`, `network`, `name`, `nick`, `addr`, `location`, `about`, `xmpp`,
`keywords`, `gender`, `photo`, `thumb`, `micro`, `forum`, `prv`, (`forum` | `prv`) AS `community`, `contact-type`, `bd` AS `birthday`, `self`
FROM `contact` WHERE `addr` = '%s' AND `uid` = %d",
- dbesc($addr),
+ DBA::escape($addr),
intval($uid)
);
// Fetch the data from the contact table with "uid=0" (which is filled automatically)
$r = q("SELECT `id`, 0 AS `cid`, `id` AS `zid`, 0 AS `gid`, `uid`, `url`, `nurl`, `alias`, `network`, `name`, `nick`, `addr`, `location`, `about`, `xmpp`,
`keywords`, `gender`, `photo`, `thumb`, `micro`, `forum`, `prv`, (`forum` | `prv`) AS `community`, `contact-type`, `bd` AS `birthday`, 0 AS `self`
FROM `contact` WHERE `addr` = '%s' AND `uid` = 0",
- dbesc($addr)
+ DBA::escape($addr)
);
}
$r = q("SELECT 0 AS `id`, 0 AS `cid`, `id` AS `gid`, 0 AS `zid`, 0 AS `uid`, `url`, `nurl`, `alias`, `network`, `name`, `nick`, `addr`, `location`, `about`, '' AS `xmpp`,
`keywords`, `gender`, `photo`, `photo` AS `thumb`, `photo` AS `micro`, `community` AS `forum`, 0 AS `prv`, `community`, `contact-type`, `birthday`, 0 AS `self`
FROM `gcontact` WHERE `addr` = '%s'",
- dbesc($addr)
+ DBA::escape($addr)
);
}
// This speeds up the query a lot
$r = q("SELECT `network`, `id` AS `author-id`, `contact-type` FROM `contact`
WHERE `contact`.`nurl` = '%s' AND `contact`.`uid` = 0",
- dbesc(normalise_link($contact_url))
+ DBA::escape(normalise_link($contact_url))
);
if (!DBA::isResult($r)) {
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `poll` IN ('%s', '%s') AND `network` = '%s' AND NOT `pending` LIMIT 1",
intval($uid),
- dbesc($ret['poll']),
- dbesc(normalise_link($ret['poll'])),
- dbesc($ret['network'])
+ DBA::escape($ret['poll']),
+ DBA::escape(normalise_link($ret['poll'])),
+ DBA::escape($ret['network'])
);
if (!DBA::isResult($r)) {
$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND `network` = '%s' AND NOT `pending` LIMIT 1",
intval($uid),
- dbesc(normalise_link($url)),
- dbesc($ret['network'])
+ DBA::escape(normalise_link($url)),
+ DBA::escape($ret['network'])
);
}
`blocked`, `readonly`, `pending`, `writable`)
VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, 0, 0, 1, 1)",
intval($importer['uid']),
- dbesc(DateTimeFormat::utcNow()),
- dbesc($url),
- dbesc(normalise_link($url)),
- dbesc($name),
- dbesc($nick),
- dbesc($photo),
- dbesc(NETWORK_OSTATUS),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape($url),
+ DBA::escape(normalise_link($url)),
+ DBA::escape($name),
+ DBA::escape($nick),
+ DBA::escape($photo),
+ DBA::escape(NETWORK_OSTATUS),
intval(CONTACT_IS_FOLLOWER)
);
} elseif (DBA::isResult($user) && in_array($user['page-flags'], [PAGE_SOAPBOX, PAGE_FREELOVE, PAGE_COMMUNITY])) {
q("UPDATE `contact` SET `pending` = 0 WHERE `uid` = %d AND `url` = '%s' AND `pending` LIMIT 1",
intval($importer['uid']),
- dbesc($url)
+ DBA::escape($url)
);
}
}
// Check for duplicates
$s = q("SELECT `id` FROM `event` WHERE `uid` = %d AND `cid` = %d AND `start` = '%s' AND `type` = '%s' LIMIT 1",
- intval($rr['uid']), intval($rr['id']), dbesc(DateTimeFormat::utc($nextbd)), dbesc('birthday'));
+ intval($rr['uid']), intval($rr['id']), DBA::escape(DateTimeFormat::utc($nextbd)), DBA::escape('birthday'));
if (DBA::isResult($s)) {
continue;
q("INSERT INTO `event` (`uid`,`cid`,`created`,`edited`,`start`,`finish`,`summary`,`desc`,`type`,`adjust`)
VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%d' ) ", intval($rr['uid']), intval($rr['id']),
- dbesc(DateTimeFormat::utcNow()), dbesc(DateTimeFormat::utcNow()), dbesc(DateTimeFormat::utc($nextbd)),
- dbesc(DateTimeFormat::utc($nextbd . ' + 1 day ')), dbesc($bdtext), dbesc($bdtext2), dbesc('birthday'),
+ DBA::escape(DateTimeFormat::utcNow()), DBA::escape(DateTimeFormat::utcNow()), DBA::escape(DateTimeFormat::utc($nextbd)),
+ DBA::escape(DateTimeFormat::utc($nextbd . ' + 1 day ')), DBA::escape($bdtext), DBA::escape($bdtext2), DBA::escape('birthday'),
intval(0)
);
// update bdyear
- q("UPDATE `contact` SET `bdyear` = '%s', `bd` = '%s' WHERE `uid` = %d AND `id` = %d", dbesc(substr($nextbd, 0, 4)),
- dbesc($nextbd), intval($rr['uid']), intval($rr['id'])
+ q("UPDATE `contact` SET `bdyear` = '%s', `bd` = '%s' WHERE `uid` = %d AND `id` = %d", DBA::escape(substr($nextbd, 0, 4)),
+ DBA::escape($nextbd), intval($rr['uid']), intval($rr['id'])
);
}
}
return;
}
- $str = dbesc(implode(',', $contact_ids));
+ $str = DBA::escape(implode(',', $contact_ids));
$stmt = DBA::p("SELECT `id` FROM `contact` WHERE `id` IN ( " . $str . ") AND `blocked` = 0 AND `pending` = 0 AND `archive` = 0");
$sql_extra ",
intval($owner_uid),
intval($event_params["ignore"]),
- dbesc($event_params["start"]),
- dbesc($event_params["start"]),
- dbesc($event_params["finish"]),
- dbesc($event_params["adjust_start"]),
- dbesc($event_params["adjust_start"]),
- dbesc($event_params["adjust_finish"])
+ DBA::escape($event_params["start"]),
+ DBA::escape($event_params["start"]),
+ DBA::escape($event_params["finish"]),
+ DBA::escape($event_params["adjust_start"]),
+ DBA::escape($event_params["adjust_start"]),
+ DBA::escape($event_params["adjust_finish"])
);
if (DBA::isResult($r)) {
intval($uid),
intval($gcid),
intval($zcid),
- dbesc(DateTimeFormat::utcNow())
+ DBA::escape(DateTimeFormat::utcNow())
);
} else {
q(
"UPDATE `glink` SET `updated` = '%s' WHERE `cid` = %d AND `uid` = %d AND `gcid` = %d AND `zcid` = %d",
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
intval($cid),
intval($uid),
intval($gcid),
if (!isset($gcontact['network'])) {
$r = q(
"SELECT `network` FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' AND `network` != '' AND `network` != '%s' LIMIT 1",
- dbesc(normalise_link($gcontact['url'])),
- dbesc(NETWORK_STATUSNET)
+ DBA::escape(normalise_link($gcontact['url'])),
+ DBA::escape(NETWORK_STATUSNET)
);
if (DBA::isResult($r)) {
$gcontact['network'] = $r[0]["network"];
if (($gcontact['network'] == "") || ($gcontact['network'] == NETWORK_OSTATUS)) {
$r = q(
"SELECT `network`, `url` FROM `contact` WHERE `uid` = 0 AND `alias` IN ('%s', '%s') AND `network` != '' AND `network` != '%s' LIMIT 1",
- dbesc($gcontact['url']),
- dbesc(normalise_link($gcontact['url'])),
- dbesc(NETWORK_STATUSNET)
+ DBA::escape($gcontact['url']),
+ DBA::escape(normalise_link($gcontact['url'])),
+ DBA::escape(NETWORK_STATUSNET)
);
if (DBA::isResult($r)) {
$gcontact['network'] = $r[0]["network"];
$x = q(
"SELECT * FROM `gcontact` WHERE `nurl` = '%s' LIMIT 1",
- dbesc(normalise_link($gcontact['url']))
+ DBA::escape(normalise_link($gcontact['url']))
);
if (DBA::isResult($x)) {
intval($uid),
intval($uid),
intval($uid),
- dbesc(NULL_DATE),
+ DBA::escape(NULL_DATE),
$sql_network,
intval($start),
intval($limit)
intval($uid),
intval($uid),
intval($uid),
- dbesc(NULL_DATE),
+ DBA::escape(NULL_DATE),
$sql_network,
intval($start),
intval($limit)
// Query your contacts from Friendica and Redmatrix/Hubzilla for their contacts
$r = q(
"SELECT DISTINCT(`poco`) AS `poco` FROM `contact` WHERE `network` IN ('%s', '%s')",
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA)
);
if (DBA::isResult($r)) {
DBA::lock('gcontact');
$r = q(
"SELECT `id`, `last_contact`, `last_failure`, `network` FROM `gcontact` WHERE `nurl` = '%s' LIMIT 1",
- dbesc(normalise_link($contact["url"]))
+ DBA::escape(normalise_link($contact["url"]))
);
if (DBA::isResult($r)) {
q(
"INSERT INTO `gcontact` (`name`, `nick`, `addr` , `network`, `url`, `nurl`, `photo`, `created`, `updated`, `location`, `about`, `hide`, `generation`)
VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d)",
- dbesc($contact["name"]),
- dbesc($contact["nick"]),
- dbesc($contact["addr"]),
- dbesc($contact["network"]),
- dbesc($contact["url"]),
- dbesc(normalise_link($contact["url"])),
- dbesc($contact["photo"]),
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utcNow()),
- dbesc($contact["location"]),
- dbesc($contact["about"]),
+ DBA::escape($contact["name"]),
+ DBA::escape($contact["nick"]),
+ DBA::escape($contact["addr"]),
+ DBA::escape($contact["network"]),
+ DBA::escape($contact["url"]),
+ DBA::escape(normalise_link($contact["url"])),
+ DBA::escape($contact["photo"]),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape($contact["location"]),
+ DBA::escape($contact["about"]),
intval($contact["hide"]),
intval($contact["generation"])
);
$r = q(
"SELECT `id`, `network` FROM `gcontact` WHERE `nurl` = '%s' ORDER BY `id` LIMIT 2",
- dbesc(normalise_link($contact["url"]))
+ DBA::escape(normalise_link($contact["url"]))
);
if (DBA::isResult($r)) {
$r = q(
"SELECT `nurl`, `url` FROM `gserver` WHERE `last_contact` >= `last_failure` AND `network` = '%s' AND `last_poco_query` < '%s' ORDER BY RAND() LIMIT 5",
- dbesc(NETWORK_OSTATUS),
- dbesc($last_update)
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape($last_update)
);
if (!DBA::isResult($r)) {
foreach ($r as $server) {
self::fetchGsUsers($server["url"]);
- q("UPDATE `gserver` SET `last_poco_query` = '%s' WHERE `nurl` = '%s'", dbesc(DateTimeFormat::utcNow()), dbesc($server["nurl"]));
+ q("UPDATE `gserver` SET `last_poco_query` = '%s' WHERE `nurl` = '%s'", DBA::escape(DateTimeFormat::utcNow()), DBA::escape($server["nurl"]));
}
}
AND `last_contact` >= `last_failure`
AND `updated` > UTC_TIMESTAMP - INTERVAL 1 MONTH
ORDER BY rand() LIMIT 1",
- dbesc(NETWORK_DFRN)
+ DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {
$reply = true;
$r = q("SELECT `convid` FROM `mail` WHERE `uid` = %d AND (`uri` = '%s' OR `parent-uri` = '%s') LIMIT 1",
intval(local_user()),
- dbesc($replyto),
- dbesc($replyto)
+ DBA::escape($replyto),
+ DBA::escape($replyto)
);
if (DBA::isResult($r)) {
$convid = $r[0]['convid'];
WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s' $sql_extra
GROUP BY `album` ORDER BY `created` DESC",
intval($uid),
- dbesc('Contact Photos'),
- dbesc(L10n::t('Contact Photos'))
+ DBA::escape('Contact Photos'),
+ DBA::escape(L10n::t('Contact Photos'))
);
} else {
// This query doesn't do the count and is much faster
FROM `photo` USE INDEX (`uid_album_scale_created`)
WHERE `uid` = %d AND `album` != '%s' AND `album` != '%s' $sql_extra",
intval($uid),
- dbesc('Contact Photos'),
- dbesc(L10n::t('Contact Photos'))
+ DBA::escape('Contact Photos'),
+ DBA::escape(L10n::t('Contact Photos'))
);
}
Cache::set($key, $albums, CACHE_DAY);
$r = q(
"SELECT `url` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND `rel` = %d",
intval($profile['uid']),
- dbesc(normalise_link(self::getMyURL())),
+ DBA::escape(normalise_link(self::getMyURL())),
intval(CONTACT_IS_FRIEND)
);
}
AND NOT `hidden` AND NOT `archive`
AND `network` IN ('%s', '%s', '%s', '')",
intval($profile['uid']),
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS)
);
if (DBA::isResult($r)) {
$contacts = intval($r[0]['total']);
"SELECT `contact`.*, `user`.`nickname`, `user`.`timezone`, `user`.`page-flags`, `user`.`account-type`
FROM `contact` INNER JOIN `user` ON `user`.`uid` = `contact`.`uid`
WHERE `contact`.`self` AND `user`.`nickname` = '%s' LIMIT 1",
- dbesc($owner_nick)
+ DBA::escape($owner_nick)
);
if (! DBA::isResult($r)) {
$sql_extra = '';
switch ($direction) {
case (-1):
- $sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id));
$my_id = $dfrn_id;
break;
case 0:
- $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '1:' . $dfrn_id;
break;
case 1:
- $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id));
+ $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id));
$my_id = '0:' . $dfrn_id;
break;
default:
",
intval($contact['id']),
intval($contact['id']),
- dbesc($gs),
- dbesc($gs)
+ DBA::escape($gs),
+ DBA::escape($gs)
);
}
if (isset($category)) {
$sql_post_table = sprintf(
"INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ",
- dbesc(protect_sprintf($category)),
+ DBA::escape(protect_sprintf($category)),
intval(TERM_OBJ_POST),
intval(TERM_CATEGORY),
intval($owner_id)
$sql_extra
ORDER BY `item`.`parent` ".$sort.", `item`.`created` ASC LIMIT 0, 300",
intval($owner_id),
- dbesc($check_date),
- dbesc($sort)
+ DBA::escape($check_date),
+ DBA::escape($sort)
);
$ids = [];
$r = q(
"SELECT `forum`, `prv` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s'",
intval($owner["uid"]),
- dbesc(normalise_link($mention))
+ DBA::escape(normalise_link($mention))
);
if (DBA::isResult($r) && ($r[0]["forum"] || $r[0]["prv"])) {
"SELECT `id` FROM `event` WHERE `uid` = %d AND `cid` = %d AND `start` = '%s' AND `type` = '%s' LIMIT 1",
intval($contact['uid']),
intval($contact['id']),
- dbesc(DateTimeFormat::utc($birthday)),
- dbesc('birthday')
+ DBA::escape(DateTimeFormat::utc($birthday)),
+ DBA::escape('birthday')
);
if (DBA::isResult($r)) {
VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s') ",
intval($contact['uid']),
intval($contact['id']),
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utc($birthday)),
- dbesc(DateTimeFormat::utc($birthday . ' + 1 day ')),
- dbesc($bdtext),
- dbesc($bdtext2),
- dbesc('birthday')
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utc($birthday)),
+ DBA::escape(DateTimeFormat::utc($birthday . ' + 1 day ')),
+ DBA::escape($bdtext),
+ DBA::escape($bdtext2),
+ DBA::escape('birthday')
);
}
`addr` = '%s', `keywords` = '%s', `bdyear` = '%s', `bd` = '%s', `hidden` = %d,
`xmpp` = '%s', `name-date` = '%s', `uri-date` = '%s'
WHERE `id` = %d AND `network` = '%s'",
- dbesc($contact["name"]), dbesc($contact["nick"]), dbesc($contact["about"]), dbesc($contact["location"]),
- dbesc($contact["addr"]), dbesc($contact["keywords"]), dbesc($contact["bdyear"]),
- dbesc($contact["bd"]), intval($contact["hidden"]), dbesc($contact["xmpp"]),
- dbesc(DateTimeFormat::utc($contact["name-date"])), dbesc(DateTimeFormat::utc($contact["uri-date"])),
- intval($contact["id"]), dbesc($contact["network"])
+ DBA::escape($contact["name"]), DBA::escape($contact["nick"]), DBA::escape($contact["about"]), DBA::escape($contact["location"]),
+ DBA::escape($contact["addr"]), DBA::escape($contact["keywords"]), DBA::escape($contact["bdyear"]),
+ DBA::escape($contact["bd"]), intval($contact["hidden"]), DBA::escape($contact["xmpp"]),
+ DBA::escape(DateTimeFormat::utc($contact["name-date"])), DBA::escape(DateTimeFormat::utc($contact["uri-date"])),
+ intval($contact["id"]), DBA::escape($contact["network"])
);
}
$r = q(
"SELECT `id` FROM `contact` WHERE `name` = '%s' AND `nurl` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($suggest["name"]),
- dbesc(normalise_link($suggest["url"])),
+ DBA::escape($suggest["name"]),
+ DBA::escape(normalise_link($suggest["url"])),
intval($suggest["uid"])
);
$fid = 0;
$r = q(
"SELECT `id` FROM `fcontact` WHERE `url` = '%s' AND `name` = '%s' AND `request` = '%s' LIMIT 1",
- dbesc($suggest["url"]),
- dbesc($suggest["name"]),
- dbesc($suggest["request"])
+ DBA::escape($suggest["url"]),
+ DBA::escape($suggest["name"]),
+ DBA::escape($suggest["request"])
);
if (DBA::isResult($r)) {
$fid = $r[0]["id"];
if (!$fid) {
$r = q(
"INSERT INTO `fcontact` (`name`,`url`,`photo`,`request`) VALUES ('%s', '%s', '%s', '%s')",
- dbesc($suggest["name"]),
- dbesc($suggest["url"]),
- dbesc($suggest["photo"]),
- dbesc($suggest["request"])
+ DBA::escape($suggest["name"]),
+ DBA::escape($suggest["url"]),
+ DBA::escape($suggest["photo"]),
+ DBA::escape($suggest["request"])
);
}
$r = q(
"SELECT `id` FROM `fcontact` WHERE `url` = '%s' AND `name` = '%s' AND `request` = '%s' LIMIT 1",
- dbesc($suggest["url"]),
- dbesc($suggest["name"]),
- dbesc($suggest["request"])
+ DBA::escape($suggest["url"]),
+ DBA::escape($suggest["name"]),
+ DBA::escape($suggest["request"])
);
/*
intval($suggest["uid"]),
intval($fid),
intval($suggest["cid"]),
- dbesc($suggest["body"]),
- dbesc($hash),
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape($suggest["body"]),
+ DBA::escape($hash),
+ DBA::escape(DateTimeFormat::utcNow()),
intval(0)
);
AND `item`.`uid` = %d
$sql_extra
LIMIT 1",
- dbesc($parent["parent-uri"]),
- dbesc($parent["parent-uri"]),
- dbesc($parent["parent-uri"]),
+ DBA::escape($parent["parent-uri"]),
+ DBA::escape($parent["parent-uri"]),
+ DBA::escape($parent["parent-uri"]),
intval($importer["importer_uid"])
);
if (DBA::isResult($r)) {
$r = q(
"SELECT `id` FROM `event` WHERE `uri` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($item["uri"]),
+ DBA::escape($item["uri"]),
intval($importer["importer_uid"])
);
if (DBA::isResult($r)) {
/// @todo Why is there a query for "url" *and* "nurl"? Especially this normalising is strange.
$r = q("SELECT `id` FROM `contact` WHERE `uid` = (SELECT `uid` FROM `user` WHERE `nickname` = '%s' LIMIT 1)
AND `nick` = '%s' AND NOT `self` AND (`url` LIKE '%%%s%%' OR `nurl` LIKE '%%%s%%') AND NOT `blocked` AND NOT `pending` LIMIT 1",
- dbesc($contact_nick),
- dbesc($a->user['nickname']),
- dbesc($baseurl),
- dbesc($nurl)
+ DBA::escape($contact_nick),
+ DBA::escape($a->user['nickname']),
+ DBA::escape($baseurl),
+ DBA::escape($nurl)
);
if ((! DBA::isResult($r)) || $r[0]['id'] == remote_user()) {
return;
$r = q("SELECT * FROM contact WHERE nick = '%s'
AND network = '%s' AND uid = %d AND url LIKE '%%%s%%' LIMIT 1",
- dbesc($contact_nick),
- dbesc(NETWORK_DFRN),
+ DBA::escape($contact_nick),
+ DBA::escape(NETWORK_DFRN),
intval(local_user()),
- dbesc($baseurl)
+ DBA::escape($baseurl)
);
if (! DBA::isResult($r)) {
return;
$r = q(
"SELECT `url` FROM `fcontact` WHERE `url` != '' AND `network` = '%s' AND `guid` = '%s'",
- dbesc(NETWORK_DIASPORA),
- dbesc($fcontact_guid)
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape($fcontact_guid)
);
if (DBA::isResult($r)) {
$r = q(
"SELECT `id` FROM `mail` WHERE `guid` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($msg_guid),
+ DBA::escape($msg_guid),
intval($importer["uid"])
);
if (DBA::isResult($r)) {
"INSERT INTO `mail` (`uid`, `guid`, `convid`, `from-name`,`from-photo`,`from-url`,`contact-id`,`title`,`body`,`seen`,`reply`,`uri`,`parent-uri`,`created`)
VALUES (%d, '%s', %d, '%s', '%s', '%s', %d, '%s', '%s', %d, %d, '%s','%s','%s')",
intval($importer["uid"]),
- dbesc($msg_guid),
+ DBA::escape($msg_guid),
intval($conversation["id"]),
- dbesc($person["name"]),
- dbesc($person["photo"]),
- dbesc($person["url"]),
+ DBA::escape($person["name"]),
+ DBA::escape($person["photo"]),
+ DBA::escape($person["url"]),
intval($contact["id"]),
- dbesc($subject),
- dbesc($body),
+ DBA::escape($subject),
+ DBA::escape($body),
0,
0,
- dbesc($message_uri),
- dbesc($author.":".$guid),
- dbesc($msg_created_at)
+ DBA::escape($message_uri),
+ DBA::escape($author.":".$guid),
+ DBA::escape($msg_created_at)
);
DBA::unlock();
$c = q(
"SELECT * FROM `conv` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1",
intval($importer["uid"]),
- dbesc($guid)
+ DBA::escape($guid)
);
if ($c)
$conversation = $c[0];
"INSERT INTO `conv` (`uid`, `guid`, `creator`, `created`, `updated`, `subject`, `recips`)
VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s')",
intval($importer["uid"]),
- dbesc($guid),
- dbesc($author),
- dbesc($created_at),
- dbesc(DateTimeFormat::utcNow()),
- dbesc($subject),
- dbesc($participants)
+ DBA::escape($guid),
+ DBA::escape($author),
+ DBA::escape($created_at),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape($subject),
+ DBA::escape($participants)
);
if ($r) {
$c = q(
"SELECT * FROM `conv` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1",
intval($importer["uid"]),
- dbesc($guid)
+ DBA::escape($guid)
);
}
$c = q(
"SELECT * FROM `conv` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1",
intval($importer["uid"]),
- dbesc($conversation_guid)
+ DBA::escape($conversation_guid)
);
if ($c) {
$conversation = $c[0];
$r = q(
"SELECT `id` FROM `mail` WHERE `guid` = '%s' AND `uid` = %d LIMIT 1",
- dbesc($guid),
+ DBA::escape($guid),
intval($importer["uid"])
);
if (DBA::isResult($r)) {
"INSERT INTO `mail` (`uid`, `guid`, `convid`, `from-name`,`from-photo`,`from-url`,`contact-id`,`title`,`body`,`seen`,`reply`,`uri`,`parent-uri`,`created`)
VALUES ( %d, '%s', %d, '%s', '%s', '%s', %d, '%s', '%s', %d, %d, '%s','%s','%s')",
intval($importer["uid"]),
- dbesc($guid),
+ DBA::escape($guid),
intval($conversation["id"]),
- dbesc($person["name"]),
- dbesc($person["photo"]),
- dbesc($person["url"]),
+ DBA::escape($person["name"]),
+ DBA::escape($person["photo"]),
+ DBA::escape($person["url"]),
intval($contact["id"]),
- dbesc($conversation["subject"]),
- dbesc($body),
+ DBA::escape($conversation["subject"]),
+ DBA::escape($body),
0,
1,
- dbesc($message_uri),
- dbesc($author.":".$conversation["guid"]),
- dbesc($created_at)
+ DBA::escape($message_uri),
+ DBA::escape($author.":".$conversation["guid"]),
+ DBA::escape($created_at)
);
DBA::unlock();
"INSERT INTO `contact` (`uid`, `network`,`addr`,`created`,`url`,`nurl`,`batch`,`name`,`nick`,`photo`,`pubkey`,`notify`,`poll`,`blocked`,`priority`)
VALUES (%d, '%s', '%s', '%s', '%s','%s','%s','%s','%s','%s','%s','%s','%s',%d,%d)",
intval($importer["uid"]),
- dbesc($ret["network"]),
- dbesc($ret["addr"]),
+ DBA::escape($ret["network"]),
+ DBA::escape($ret["addr"]),
DateTimeFormat::utcNow(),
- dbesc($ret["url"]),
- dbesc(normalise_link($ret["url"])),
- dbesc($batch),
- dbesc($ret["name"]),
- dbesc($ret["nick"]),
- dbesc($ret["photo"]),
- dbesc($ret["pubkey"]),
- dbesc($ret["notify"]),
- dbesc($ret["poll"]),
+ DBA::escape($ret["url"]),
+ DBA::escape(normalise_link($ret["url"])),
+ DBA::escape($batch),
+ DBA::escape($ret["name"]),
+ DBA::escape($ret["nick"]),
+ DBA::escape($ret["photo"]),
+ DBA::escape($ret["pubkey"]),
+ DBA::escape($ret["notify"]),
+ DBA::escape($ret["poll"]),
1,
2
);
intval($contact_record["id"]),
0,
0,
- dbesc(L10n::t("Sharing notification from Diaspora network")),
- dbesc($hash),
- dbesc(DateTimeFormat::utcNow())
+ DBA::escape(L10n::t("Sharing notification from Diaspora network")),
+ DBA::escape($hash),
+ DBA::escape(DateTimeFormat::utcNow())
);
} else {
// automatic friend approval
WHERE `id` = %d
",
intval($new_relation),
- dbesc(DateTimeFormat::utcNow()),
- dbesc(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
+ DBA::escape(DateTimeFormat::utcNow()),
intval($contact_record["id"])
);
$recips = q(
"SELECT `id`,`name`,`network`,`pubkey`,`notify` FROM `contact` WHERE `network` = '%s'
AND `uid` = %d AND `rel` != %d",
- dbesc(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_DIASPORA),
intval($uid),
intval(CONTACT_IS_SHARING)
);
{
$r = q(
"SELECT * FROM `contact` WHERE `nurl` = '%s' AND `uid` IN (0, %d) ORDER BY `uid` DESC LIMIT 1",
- dbesc(normalise_link($url)),
+ DBA::escape(normalise_link($url)),
intval($owner["uid"])
);
if (DBA::isResult($r)) {
if (!DBA::isResult($r)) {
$r = q(
"SELECT * FROM `gcontact` WHERE `nurl` = '%s' LIMIT 1",
- dbesc(normalise_link($url))
+ DBA::escape(normalise_link($url))
);
if (DBA::isResult($r)) {
$contact = $r[0];
$r = q(
"SELECT `id` FROM `contact` WHERE `uid` = %d AND `nurl` = '%s'",
intval($owner['uid']),
- dbesc(normalise_link($contact["url"]))
+ DBA::escape(normalise_link($contact["url"]))
);
if (DBA::isResult($r)) {
$r = q(
"SELECT `id` FROM `gserver` WHERE `nurl` = '%s' AND `last_contact` > `last_failure`",
- dbesc(normalise_link($server_url))
+ DBA::escape(normalise_link($server_url))
);
if (DBA::isResult($r)) {
{
$gcontacts = q(
"SELECT * FROM `gcontact` WHERE `nurl` = '%s'",
- dbesc(normalise_link($profile))
+ DBA::escape(normalise_link($profile))
);
if (!DBA::isResult($gcontacts)) {
if (in_array($gcontacts[0]["network"], ["", NETWORK_FEED])) {
$server = q(
"SELECT `network` FROM `gserver` WHERE `nurl` = '%s' AND `network` != ''",
- dbesc(normalise_link($server_url))
+ DBA::escape(normalise_link($server_url))
);
if ($server) {
// noscrape is really fast so we don't cache the call.
if (($server_url != "") && ($gcontacts[0]["nick"] != "")) {
// Use noscrape if possible
- $server = q("SELECT `noscrape`, `network` FROM `gserver` WHERE `nurl` = '%s' AND `noscrape` != ''", dbesc(normalise_link($server_url)));
+ $server = q("SELECT `noscrape`, `network` FROM `gserver` WHERE `nurl` = '%s' AND `noscrape` != ''", DBA::escape(normalise_link($server_url)));
if ($server) {
$noscraperet = Network::curl($server[0]["noscrape"]."/".$gcontacts[0]["nick"]);
WHERE `network` IN ('%s', '%s', '%s') AND `last_contact` > `last_failure`
ORDER BY `last_contact`
LIMIT 1000",
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS)
);
if (!DBA::isResult($r)) {
foreach ($serverlist as $server) {
$server_url = str_replace("/index.php", "", $server->url);
- $r = q("SELECT `nurl` FROM `gserver` WHERE `nurl` = '%s'", dbesc(normalise_link($server_url)));
+ $r = q("SELECT `nurl` FROM `gserver` WHERE `nurl` = '%s'", DBA::escape(normalise_link($server_url)));
if (!DBA::isResult($r)) {
logger("Call server check for server ".$server_url, LOGGER_DEBUG);
Worker::add(PRIORITY_LOW, "DiscoverPoCo", "server", $server_url);
}
$last_update = date("c", time() - (60 * 60 * 24 * $requery_days));
- $r = q("SELECT `id`, `url`, `nurl`, `network` FROM `gserver` WHERE `last_contact` >= `last_failure` AND `poco` != '' AND `last_poco_query` < '%s' ORDER BY RAND()", dbesc($last_update));
+ $r = q("SELECT `id`, `url`, `nurl`, `network` FROM `gserver` WHERE `last_contact` >= `last_failure` AND `poco` != '' AND `last_poco_query` < '%s' ORDER BY RAND()", DBA::escape($last_update));
if (DBA::isResult($r)) {
foreach ($r as $server) {
if (!self::checkServer($server["url"], $server["network"])) {
logger("Checking VERSION from: ".$checked_url, LOGGER_DEBUG);
// fetch the VERSION file
- $gitversion = dbesc(trim(Network::fetchUrl($checked_url)));
+ $gitversion = DBA::escape(trim(Network::fetchUrl($checked_url)));
logger("Upstream VERSION is: ".$gitversion, LOGGER_DEBUG);
Config::set('system', 'git_friendica_version', $gitversion);
AND `contact`.`network` IN ('%s', '%s', '%s', '%s', '%s') $sql_extra
AND NOT `contact`.`self` AND NOT `contact`.`blocked`
WHERE NOT `user`.`account_expired` AND NOT `user`.`account_removed` $abandon_sql",
- dbesc(NETWORK_DFRN),
- dbesc(NETWORK_OSTATUS),
- dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_FEED),
- dbesc(NETWORK_MAIL)
+ DBA::escape(NETWORK_DFRN),
+ DBA::escape(NETWORK_OSTATUS),
+ DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_FEED),
+ DBA::escape(NETWORK_MAIL)
);
if (!DBA::isResult($contacts)) {
use Friendica\Core\Cache;
use Friendica\Core\Config;
use Friendica\Database\DBA;
-use Friendica\Database\PostUpdate;
use Friendica\Model\Contact;
use Friendica\Model\GContact;
use Friendica\Model\Photo;
// So optimize it
logger("Optimize Table " . $table["Name"], LOGGER_DEBUG);
- q("OPTIMIZE TABLE `%s`", dbesc($table["Name"]));
+ q("OPTIMIZE TABLE `%s`", DBA::escape($table["Name"]));
}
}
$r = q("SELECT `id`, `url` FROM `contact`
WHERE `network` = '%s' AND (`batch` = '' OR `notify` = '' OR `poll` = '' OR pubkey = '')
- ORDER BY RAND() LIMIT 50", dbesc(NETWORK_DIASPORA));
+ ORDER BY RAND() LIMIT 50", DBA::escape(NETWORK_DIASPORA));
if (!DBA::isResult($r)) {
return;
}
logger("Repair contact " . $contact["id"] . " " . $contact["url"], LOGGER_DEBUG);
q("UPDATE `contact` SET `batch` = '%s', `notify` = '%s', `poll` = '%s', pubkey = '%s' WHERE `id` = %d",
- dbesc($data["batch"]), dbesc($data["notify"]), dbesc($data["poll"]), dbesc($data["pubkey"]),
+ DBA::escape($data["batch"]), DBA::escape($data["notify"]), DBA::escape($data["poll"]), DBA::escape($data["pubkey"]),
intval($contact["id"]));
}
}
WHERE `last_contact` < UTC_TIMESTAMP - INTERVAL 1 MONTH AND
`last_failure` < UTC_TIMESTAMP - INTERVAL 1 MONTH AND
`network` IN ('%s', '%s', '%s', '%s', '') ORDER BY rand()",
- dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA),
- dbesc(NETWORK_OSTATUS), dbesc(NETWORK_FEED));
+ DBA::escape(NETWORK_DFRN), DBA::escape(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_OSTATUS), DBA::escape(NETWORK_FEED));
if (!$users) {
return;
$r = q(
"SELECT `id`, `url`, `network` FROM `gcontact` WHERE `nurl` = '%s' ORDER BY `id` LIMIT 1",
- dbesc(normalise_link($url))
+ DBA::escape(normalise_link($url))
);
logger("gprobe start for ".normalise_link($url), LOGGER_DEBUG);
$r = q(
"SELECT `id`, `url`, `network` FROM `gcontact` WHERE `nurl` = '%s' ORDER BY `id` LIMIT 1",
- dbesc(normalise_link($url))
+ DBA::escape(normalise_link($url))
);
}
if (DBA::isResult($r)) {
// local followup to remote post
$followup = true;
$public_message = false; // not public
- $conversant_str = dbesc($parent['contact-id']);
+ $conversant_str = DBA::escape($parent['contact-id']);
$recipients = [$parent['contact-id']];
$recipients_followup = [$parent['contact-id']];
// Currently it is work at progress
$r = q("SELECT `id` FROM `contact` WHERE `uid` = %d AND `network` = '%s' AND NOT `blocked` AND NOT `pending` AND NOT `archive`",
intval($uid),
- dbesc(NETWORK_DFRN)
+ DBA::escape(NETWORK_DFRN)
);
if (DBA::isResult($r)) {
foreach ($r as $rr) {
$deny = array_unique(array_merge($deny_people,$deny_groups));
$recipients = array_diff($recipients,$deny);
- $conversant_str = dbesc(implode(', ',$conversants));
+ $conversant_str = DBA::escape(implode(', ',$conversants));
}
// If the thread parent is OStatus then do some magic to distribute the messages.
&& intval($target_item['pubmail'])) {
$r = q("SELECT `id` FROM `contact` WHERE `uid` = %d AND `network` = '%s'",
intval($uid),
- dbesc(NETWORK_MAIL)
+ DBA::escape(NETWORK_MAIL)
);
if (DBA::isResult($r)) {
foreach ($r as $rr) {
$r1 = q("SELECT `batch`, ANY_VALUE(`id`) AS `id`, ANY_VALUE(`name`) AS `name`, ANY_VALUE(`network`) AS `network`
FROM `contact` WHERE `network` = '%s' AND `batch` != ''
AND `uid` = %d AND `rel` != %d AND NOT `blocked` AND NOT `pending` AND NOT `archive` GROUP BY `batch`",
- dbesc(NETWORK_DIASPORA),
+ DBA::escape(NETWORK_DIASPORA),
intval($owner['uid']),
intval(CONTACT_IS_SHARING)
);
}
q("UPDATE `gcontact` SET `last_failure` = '%s' WHERE `id` = %d",
- dbesc(DateTimeFormat::utcNow()), intval($contact_id));
+ DBA::escape(DateTimeFormat::utcNow()), intval($contact_id));
return;
}
q("UPDATE `gcontact` SET `name` = '%s', `nick` = '%s', `addr` = '%s', `photo` = '%s'
WHERE `id` = %d",
- dbesc($data["name"]),
- dbesc($data["nick"]),
- dbesc($data["addr"]),
- dbesc($data["photo"]),
+ DBA::escape($data["name"]),
+ DBA::escape($data["nick"]),
+ DBA::escape($data["addr"]),
+ DBA::escape($data["photo"]),
intval($contact_id)
);
q("UPDATE `contact` SET `name` = '%s', `nick` = '%s', `addr` = '%s', `photo` = '%s'
WHERE `uid` = 0 AND `addr` = '' AND `nurl` = '%s'",
- dbesc($data["name"]),
- dbesc($data["nick"]),
- dbesc($data["addr"]),
- dbesc($data["photo"]),
- dbesc(normalise_link($data["url"]))
+ DBA::escape($data["name"]),
+ DBA::escape($data["nick"]),
+ DBA::escape($data["addr"]),
+ DBA::escape($data["photo"]),
+ DBA::escape(normalise_link($data["url"]))
);
q("UPDATE `contact` SET `addr` = '%s'
WHERE `uid` != 0 AND `addr` = '' AND `nurl` = '%s'",
- dbesc($data["addr"]),
- dbesc(normalise_link($data["url"]))
+ DBA::escape($data["addr"]),
+ DBA::escape(normalise_link($data["url"]))
);
}
}
$profile["pub_keywords"] = profile_clean_keywords($profile["pub_keywords"]);
$r = q("UPDATE `contact` SET `about` = '%s', `location` = '%s', `keywords` = '%s', `gender` = '%s' WHERE `self` AND `uid` = %d",
- dbesc($profile["about"]),
- dbesc($profile["locality"]),
- dbesc($profile["pub_keywords"]),
- dbesc($profile["gender"]),
+ DBA::escape($profile["about"]),
+ DBA::escape($profile["locality"]),
+ DBA::escape($profile["pub_keywords"]),
+ DBA::escape($profile["gender"]),
intval($profile["uid"])
);
}
// select old formlist addon entries
$r = q("SELECT `uid`, `cat`, `k`, `v` FROM `pconfig` WHERE `cat` = '%s' ",
- dbesc('forumlist')
+ DBA::escape('forumlist')
);
// convert old forumlist addon entries in new config entries
function update_1203() {
$r = q("UPDATE `user` SET `account-type` = %d WHERE `page-flags` IN (%d, %d)",
- dbesc(ACCOUNT_TYPE_COMMUNITY), dbesc(PAGE_COMMUNITY), dbesc(PAGE_PRVGROUP));
+ DBA::escape(ACCOUNT_TYPE_COMMUNITY), DBA::escape(PAGE_COMMUNITY), DBA::escape(PAGE_PRVGROUP));
}
function update_1244() {
} elseif (Profile::getMyURL()) {
$r = q("SELECT `name`, `nick`, `photo` FROM `gcontact`
WHERE `addr` = '%s' AND `network` = 'dfrn'",
- dbesc($webbie));
+ DBA::escape($webbie));
$nav['remote'] = L10n::t('Visitor');
} else {
$r = false;
$sql_extra = '';
if ($results['search']) {
- $search_txt = dbesc(protect_sprintf(preg_quote($results['search'])));
- $sql_extra .= " AND (`attag` LIKE '%%" . dbesc($search_txt) . "%%' OR `name` LIKE '%%" . dbesc($search_txt) . "%%' OR `nick` LIKE '%%" . dbesc($search_txt) . "%%') ";
+ $search_txt = DBA::escape(protect_sprintf(preg_quote($results['search'])));
+ $sql_extra .= " AND (`attag` LIKE '%%" . $search_txt . "%%' OR `name` LIKE '%%" . $search_txt . "%%' OR `nick` LIKE '%%" . $search_txt . "%%') ";
}
if ($nets) {
- $sql_extra .= sprintf(" AND network = '%s' ", dbesc($nets));
+ $sql_extra .= sprintf(" AND network = '%s' ", DBA::escape($nets));
}
$total = 0;
use Friendica\App;
use Friendica\Content\ForumManager;
use Friendica\Core\Addon;
-use Friendica\Core\L10n;
use Friendica\Core\Config;
+use Friendica\Core\L10n;
use Friendica\Core\PConfig;
use Friendica\Core\System;
use Friendica\Database\DBA;
use Friendica\Model\Contact;
use Friendica\Model\GContact;
-use Friendica\Model\Profile;
require_once "mod/proxy.php";
$query .= ",";
}
- $query .= "'".dbesc(normalise_link(trim($helper)))."'";
+ $query .= "'".DBA::escape(normalise_link(trim($helper)))."'";
}
$r = q("SELECT `url`, `name` FROM `gcontact` WHERE `nurl` IN (%s)", $query);
projects / friendica.git / commitdiff