Fixed handling of SQL strings

diff --git a/inc/db/lib-mysqli.php b/inc/db/lib-mysqli.php
index 29c49158e4ad982588a13c36f94a54cc8d63b183..27798e9bb278d18d779545955df0261cf1261b95 100644 (file)
--- a/inc/db/lib-mysqli.php
+++ b/inc/db/lib-mysqli.php
@@ -44,7 +44,7 @@ if (!defined('__SECURITY')) {
 function sqlQuery ($sqlString, $file, $line, $enableCodes = TRUE) {
        // Is there cache?
        if (!isset($GLOBALS[__FUNCTION__][$sqlString])) {
-               //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'Called: ' . $sqlString);
+               /* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'Called: ' . $sqlString);
 
                // Trim SQL string
                $sqlStringModified = trim($sqlString);
@@ -69,7 +69,9 @@ function sqlQuery ($sqlString, $file, $line, $enableCodes = TRUE) {
                $sqlStringModified = str_replace(array(chr(9), PHP_EOL, chr(13)), array(' ', ' ', ' '), $sqlStringModified);
 
                // Compile config entries out
+               //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlStringModified=' . $sqlStringModified . ',enableCodes=' . intval($enableCodes));
                $sqlStringModified = sqlPrepareQueryString($sqlStringModified, $enableCodes);
+               //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlStringModified=' . $sqlStringModified . ',enableCodes=' . intval($enableCodes));
 
                // Cache it and remember as last SQL query
                $GLOBALS[__FUNCTION__][$sqlString] = $sqlStringModified;

diff --git a/inc/functions.php b/inc/functions.php
index f08e83420ed3fa27698613111e3aa40f341d8442..3ee3d3b1ae1cb86fc6b745d4c96b40b5460094dd 100644 (file)
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -466,7 +466,7 @@ function redirectToUrl ($url, $allowSpider = TRUE) {
        // Three different ways to debug...
        //* DEBUG: */ reportBug(__FUNCTION__, __LINE__, 'URL=' . $url);
        //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'URL=' . $url);
-       /* DEBUG: */ die($url);
+       //* DEBUG: */ die($url);
 
        // We should not sent a redirect if headers are already sent
        if (!headers_sent()) {

diff --git a/inc/sql-functions.php b/inc/sql-functions.php
index cc16793be78e0998efd184fb41cfb5c13aca1a87..5686a79ff5a863403646bf92f7521b268b27410b 100644 (file)
--- a/inc/sql-functions.php
+++ b/inc/sql-functions.php
@@ -304,7 +304,9 @@ function sqlQueryEscaped ($sqlString, $data, $file, $line, $run = TRUE, $strip =
 
        // Escape all data
        foreach ($data as $key => $value) {
+               //* DEBUG: */ logDebugMessage(basename($file) . '/' . __FUNCTION__, $line . '/' . __LINE__, 'key=' . $key . ',value=' . $value . ',run=' . intval($run) . ',strip=' . intval($strip) . ',secure=' . intval($secure));
                $dataSecured[$key] = sqlEscapeString($value, $secure, $strip);
+               //* DEBUG: */ logDebugMessage(basename($file) . '/' . __FUNCTION__, $line . '/' . __LINE__, 'dataSecured[key]=' . $dataSecured[$key]);
        } // END - foreach
 
        // Generate query
@@ -546,20 +548,23 @@ function sqlPrepareQueryString ($sqlString, $enableCodes = TRUE) {
        // Is it already cached?
        if (!isset($GLOBALS['sql_strings']['' . $sqlString . ''])) {
                // Preserve escaping and compile URI codes+config+expression code
-               $sqlString2 = FILTER_COMPILE_EXPRESSION_CODE(FILTER_COMPILE_CONFIG($sqlString));
+               $sqlString2 = str_replace(chr(92), '{BACKLASH}', $sqlString);
+               //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlString2=' . $sqlString2);
+               $sqlString2 = FILTER_COMPILE_EXPRESSION_CODE(FILTER_COMPILE_CONFIG($sqlString2));
 
                // Debug message
                //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlString2=' . $sqlString2);
 
-               // Do final compilation and revert {ESCAPE}
+               // Do final compilation and revert {BACKSLASH}
                $GLOBALS['sql_strings']['' . $sqlString . ''] = doFinalCompilation($sqlString2, FALSE, $enableCodes);
+               $GLOBALS['sql_strings']['' . $sqlString . ''] = str_replace('{BACKLASH}', chr(92), $GLOBALS['sql_strings']['' . $sqlString . '']);
        } else {
                // Log message
                //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlString=' . $sqlString . ' - CACHE!');
        }
 
        // Debug message
-       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlString=' . $sqlString . ',enableCodes=' . intval($enableCodes) . ',sql_strings=' . $GLOBALS['sql_strings']['' . $sqlString . ''] . ' - EXIT!');
+       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'sqlString=' . $sqlString . ',enableCodes=' . intval($enableCodes) . ',returned sql_string=' . $GLOBALS['sql_strings']['' . $sqlString . ''] . ' - EXIT!');
 
        // Return it
        return $GLOBALS['sql_strings']['' . $sqlString . ''];