Fixes

diff --git a/inc/db/lib-mysql3.php b/inc/db/lib-mysql3.php
index 5d346e48ff5ac65462357d97aadd9a9b2921f24a..c9b033172e552df591a0389b62c12f4f02338afa 100644 (file)
--- a/inc/db/lib-mysql3.php
+++ b/inc/db/lib-mysql3.php
@@ -295,6 +295,9 @@ function SQL_INSERTID () {
 function SQL_ESCAPE ($str, $secureString = true, $strip = true) {
        // Do we have cache?
        if (!isset($GLOBALS['sql_escapes'][''.$str.''])) {
+               // Prepare the string here
+               $str = SQL_PREPARE_SQL_STRING($str);
+
                // Secure string first? (which is the default behaviour!)
                if ($secureString === true) {
                        // Then do it here
@@ -541,12 +544,11 @@ function SQL_HASZEROAFFECTED () {
 function SQL_PREPARE_SQL_STRING ($sqlString, $enableCodes = true) {
        // Is it already cached?
        if (!isset($GLOBALS['sql_strings'][$sqlString])) {
-               // Compile config+expression code
-               $sqlString2 = FILTER_COMPILE_EXPRESSION_CODE(FILTER_COMPILE_CONFIG($sqlString));
+               // Compile URI codes+config+expression code
+               $sqlString2 = FILTER_COMPILE_EXPRESSION_CODE(FILTER_COMPILE_CONFIG(compileUriCode($sqlString)));
 
                // Do final compilation
                $GLOBALS['sql_strings'][$sqlString] = doFinalCompilation($sqlString2, false, $enableCodes);
-               //die($sqlString.'<br />'.$sqlString2.'<br />'.$GLOBALS['sql_strings'][$sqlString]);
        } // END - if
 
        // Return it

diff --git a/inc/mysql-manager.php b/inc/mysql-manager.php
index 6ceef81e5ff0dd7e415e0aa2a682555652fecc38..8d64b2201a3864d6a6b26f8df9f52bef048ad7f7 100644 (file)
--- a/inc/mysql-manager.php
+++ b/inc/mysql-manager.php
@@ -790,11 +790,16 @@ function getActionFromModuleWhat ($module, $what) {
                $module = mapModuleToTable($module);
 
                // Guest and member menu is 'main' as the default
-               if (empty($data['action'])) $data['action'] = 'main';
+               if (empty($data['action'])) {
+                       $data['action'] = 'main';
+               } // END - if
 
                // Load from database
                $result = SQL_QUERY_ESC("SELECT `action` FROM `{?_MYSQL_PREFIX?}_%s_menu` WHERE `what`='%s' LIMIT 1",
-                       array($module, $what), __FUNCTION__, __LINE__);
+                       array(
+                               $module,
+                               $what
+                       ), __FUNCTION__, __LINE__);
                if (SQL_NUMROWS($result) == 1) {
                        // Load action value and pray that this one is the right you want... ;-)
                        $data = SQL_FETCHARRAY($result);

diff --git a/inc/template-functions.php b/inc/template-functions.php
index 73e88c6ce05cef02ac10234a892621d043043ae8..ac94882546bef37c686c798d7851fedf0c609dc8 100644 (file)
--- a/inc/template-functions.php
+++ b/inc/template-functions.php
@@ -1236,7 +1236,9 @@ function debug_report_bug ($F, $L, $message = '', $sendEmail = true) {
 // Compile characters which are allowed in URLs
 function compileUriCode ($code, $simple = true) {
        // Compile constants
-       if ($simple === false) $code = str_replace('{--', '".', str_replace('--}', '."', $code));
+       if ($simple === false) {
+               $code = str_replace('{--', '".', str_replace('--}', '."', $code));
+       } // END - if
 
        // Compile QUOT and other non-HTML codes
        $code = str_replace('{DOT}', '.',