use raw db queries wherever query items could contain '%'

diff --git a/include/dba.php b/include/dba.php
index 04426319489e038eb9f5f1885470e5b5e540b770..54084d8358ea12602b794c7068ee857b97bec0d5 100644 (file)
--- a/include/dba.php
+++ b/include/dba.php
@@ -134,6 +134,16 @@ function q($sql) {
        return $ret;
 }}
 
+// raw db query, no arguments
+
+if(! function_exists('dbq')) { 
+function dbq($sql) {
+
+       global $db;
+       $ret = $db->q($sql);
+       return $ret;
+}}
+
 
 // Caller is responsible for ensuring that any integer arguments to 
 // dbesc_array are actually integers and not malformed strings containing

diff --git a/include/items.php b/include/items.php
index c10701b675abe103983cc73a9e90b130285bd7cd..20f84361300d8fd5c3ce99a1689d7cb9da214180 100644 (file)
--- a/include/items.php
+++ b/include/items.php
@@ -550,7 +550,7 @@ function item_store($arr) {
 
        logger('item_store: ' . print_r($arr,true), LOGGER_DATA);
 
-       $r = q("INSERT INTO `item` (`" 
+       $r = dbq("INSERT INTO `item` (`" 
                        . implode("`, `", array_keys($arr)) 
                        . "`) VALUES ('" 
                        . implode("', '", array_values($arr)) 

diff --git a/mod/dfrn_notify.php b/mod/dfrn_notify.php
index 745223dd7f5348f52b81d8a2a7816d8ded7d6f12..e7dbf74a112e39076f9fcd335c8efdba69e7b0ac 100644 (file)
--- a/mod/dfrn_notify.php
+++ b/mod/dfrn_notify.php
@@ -106,7 +106,7 @@ function dfrn_notify_post(&$a) {
                
                dbesc_array($msg);
 
-               $r = q("INSERT INTO `mail` (`" . implode("`, `", array_keys($msg)) 
+               $r = dbq("INSERT INTO `mail` (`" . implode("`, `", array_keys($msg)) 
                        . "`) VALUES ('" . implode("', '", array_values($msg)) . "')" );
 
                // send email notification if requested.

diff --git a/mod/profiles.php b/mod/profiles.php
index b8151eadd3d1d99c21fa0b78b138719b3fe5985e..26e8d4ec5e0f09beeb6bb5abb733fd3f4c6ff6da 100644 (file)
--- a/mod/profiles.php
+++ b/mod/profiles.php
@@ -249,7 +249,7 @@ function profiles_content(&$a) {
 
                dbesc_array($r1[0]);
 
-               $r2 = q("INSERT INTO `profile` (`" 
+               $r2 = dbq("INSERT INTO `profile` (`" 
                        . implode("`, `", array_keys($r1[0])) 
                        . "`) VALUES ('" 
                        . implode("', '", array_values($r1[0]))