Naming convention applied, encodeEntities() added

diff --git a/inc/db/lib-mysql3.php b/inc/db/lib-mysql3.php
index 8880bef74aac03d79d985d0bb6be5132bab1334e..7441e5ab21d1fdac935c19fa0bd3d5827e380ab2 100644 (file)
--- a/inc/db/lib-mysql3.php
+++ b/inc/db/lib-mysql3.php
@@ -79,7 +79,7 @@ function SQL_QUERY ($sqlString, $F, $L) {
        $querytimeBefore = microtime(true);
 
        // Run SQL command
-       //* DEBUG: */ debugOutput('F=' . basename($F) . ',L=' . $L . 'sql=' . htmlentities($GLOBALS['last_sql']));
+       //* DEBUG: */ debugOutput('F=' . basename($F) . ',L=' . $L . 'sql=' . encodeEntities($GLOBALS['last_sql']));
        $result = mysql_query($GLOBALS['last_sql'], SQL_GET_LINK())
                or debug_report_bug($F, $L, 'file='. $F . ',line=' . $L . ':mysql_error()=' . mysql_error() . "\n".
 'Query string:' . $GLOBALS['last_sql']);

diff --git a/inc/filters.php b/inc/filters.php
index 260648a31993ed55ca683d1887ebdd876aa77163..1a03451c330ef7d4759dc0a5002ba3c6b05e73aa 100644 (file)
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -436,7 +436,7 @@ function FILTER_COMPILE_CONFIG ($code, $compiled = false) {
        if ($compiled === true) {
                // Run the code
                $eval = "\$GLOBALS['compiled_config'][\$uncompiled] = \"" . $GLOBALS['compiled_config'][$uncompiled] . '";';
-               //* DEBUG: */ debugOutput(__FUNCTION__.'['.__LINE__.']:<pre>' . str_replace('$', '&#36;', htmlentities($eval)) . '</pre>');
+               //* DEBUG: */ debugOutput(__FUNCTION__.'['.__LINE__.']:<pre>' . encodeEntities($eval) . '</pre>');
                eval($eval);
        } // END - if
 

diff --git a/inc/functions.php b/inc/functions.php
index 837184d15f9cd8667bebb481c4d34c3d9bd7cdd2..79edbc765de1963eaf1fe848b7c16ca33bfee638 100644 (file)
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -184,11 +184,11 @@ function doFinalCompilation ($code, $insertComments = true) {
                $newContent = '';
 
                // Compile it
-               //* DEBUG: */ debugOutput('<pre>'.htmlentities($code).'</pre>');
+               //* DEBUG: */ debugOutput('<pre>'.encodeEntities($code).'</pre>');
                $eval = '$newContent = "' . str_replace('{DQUOTE}', '"', compileCode(escapeQuotes($code))) . '";';
                //* DEBUG: */ if ($insertComments) die('<pre>'.linenumberCode($eval).'</pre>');
                eval($eval);
-               //* DEBUG: */ die('<pre>'.htmlentities($newContent).'</pre>');
+               //* DEBUG: */ die('<pre>'.encodeEntities($newContent).'</pre>');
 
                // Was that eval okay?
                if (empty($newContent)) {
@@ -578,10 +578,10 @@ function sendEmail ($toEmail, $subject, $message, $isHtml = 'N', $mailHeader = '
        if (isDebugModeEnabled()) {
                // In debug mode we want to display the mail instead of sending it away so we can debug this part
                outputHtml('<pre>
-Headers : ' . htmlentities(utf8_decode(trim($mailHeader))) . '
-To      : ' . htmlentities(utf8_decode($toEmail)) . '
-Subject : ' . htmlentities(utf8_decode($subject)) . '
-Message : ' . htmlentities(utf8_decode($message)) . '
+Headers : ' . encodeEntities(utf8_decode(trim($mailHeader))) . '
+To      : ' . encodeEntities(utf8_decode($toEmail)) . '
+Subject : ' . encodeEntities(utf8_decode($subject)) . '
+Message : ' . encodeEntities(utf8_decode($message)) . '
 </pre>');
 
                // This is always fine
@@ -3477,7 +3477,7 @@ function linenumberCode ($code)    {
                $r .= '</span>|';
 
                // Add code
-               $r .= '<span class="linetext">' . htmlentities($c) . '</span></div>';
+               $r .= '<span class="linetext">' . encodeEntities($c) . '</span></div>';
        }
 
        return '<div class="code">' . $r . '</div>';

diff --git a/inc/libs/network_functions.php b/inc/libs/network_functions.php
index 8f4e0a59f44f0879046326b953326d9b18766e3d..0950f82ccf81ac735015048ea2f01da78078c6d4 100644 (file)
--- a/inc/libs/network_functions.php
+++ b/inc/libs/network_functions.php
@@ -474,7 +474,7 @@ ORDER BY
 
        // Free the result
        SQL_FREERESULT($result);
-       //* DEBUG: */ die('<pre>'.htmlentities($content).'</pre>');
+       //* DEBUG: */ die('<pre>'.encodeEntities($content).'</pre>');
 
        // Return content
        return $content;

diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php
index 40e5d1aaca19a390ecedb67bd04f275bc5aedd6a..ed8d5e956d15860b662c3d86f9c129e9fcdac906 100644 (file)
--- a/inc/modules/admin/admin-inc.php
+++ b/inc/modules/admin/admin-inc.php
@@ -733,7 +733,7 @@ function sendAdminBuildMails ($mode, $table, $content, $id, $subjectPart = '', $
        // Is the raw userid set?
        if (postRequestParameter($userid, $id) > 0) {
                // Generate subject
-               $subjectLine = '{--MEMBER_' . strtoupper($subject) . '_' . strtoupper($table) . '_SUBJECT--}';
+               $subject = '{--MEMBER_' . strtoupper($subject) . '_' . strtoupper($table) . '_SUBJECT--}';
 
                // Load email template
                if (!empty($subjectPart)) {
@@ -743,17 +743,17 @@ function sendAdminBuildMails ($mode, $table, $content, $id, $subjectPart = '', $
                }
 
                // Send email out
-               sendEmail(postRequestParameter($userid, $id), $subjectLine, $mail);
+               sendEmail(postRequestParameter($userid, $id), $subject, $mail);
        } // END - if
 
        // Generate subject
-       $subjectLine = '{--ADMIN_' . strtoupper($subject) . '_' . strtoupper($table) . '_SUBJECT--}';
+       $subject = '{--ADMIN_' . strtoupper($subject) . '_' . strtoupper($table) . '_SUBJECT--}';
 
        // Send admin notification out
        if (!empty($subjectPart)) {
-               sendAdminNotification($subjectLine, 'admin_' . $mode . '_' . strtolower($subjectPart) . '_' . $table, $content, postRequestParameter($userid, $id));
+               sendAdminNotification($subject, 'admin_' . $mode . '_' . strtolower($subjectPart) . '_' . $table, $content, postRequestParameter($userid, $id));
        } else {
-               sendAdminNotification($subjectLine, 'admin_' . $mode . '_' . $table, $content, postRequestParameter($userid, $id));
+               sendAdminNotification($subject, 'admin_' . $mode . '_' . $table, $content, postRequestParameter($userid, $id));
        }
 }
 

diff --git a/inc/modules/admin/what-email_archiv.php b/inc/modules/admin/what-email_archiv.php
index b4df32c7465d77044acb0f44e1a1d891971d2b32..978a0a71f63b693173847d4c1482611b5c90d27f 100644 (file)
--- a/inc/modules/admin/what-email_archiv.php
+++ b/inc/modules/admin/what-email_archiv.php
@@ -48,18 +48,15 @@ if ((!defined('__SECURITY')) || (!isAdmin())) {
 // Add description as navigation point
 addMenuDescription('admin', __FILE__);
 
-// Init SQL string
-$sql = "SELECT
+// Check for maximum pages
+$result_maximum = SQL_QUERY("SELECT
        `id`, `sender`, `subject`, `text`, `receivers`, `payment_id`, `data_type`, `timestamp`, `url`, `target_send`, `cat_id`
 FROM
        `{?_MYSQL_PREFIX?}_pool`
 WHERE
        `data_type`='SEND' OR `data_type`='DELETED'
 ORDER BY
-       `timestamp` DESC";
-
-// Check for maximum pages
-$result_maximum = SQL_QUERY($sql, __FILE__, __LINE__);
+       `timestamp` DESC", __FILE__, __LINE__);
 
 // Set offset an current page to default values
 if (!isGetRequestParameterSet('page'))   setGetRequestParameter('page'  , 1);

diff --git a/inc/modules/admin/what-extensions.php b/inc/modules/admin/what-extensions.php
index 5dd017ec47ab9723deeaeeb1c25c48b54aa576e8..9458da05413f182e2fe0f63de86871738fa02828 100644 (file)
--- a/inc/modules/admin/what-extensions.php
+++ b/inc/modules/admin/what-extensions.php
@@ -319,16 +319,16 @@ ORDER BY `ext_name` ASC", __FILE__, __LINE__);
                        // id is valid so begin with registration, we first want to it's real name from task management (subject column)
                        $result = SQL_QUERY_ESC("SELECT `subject` FROM `{?_MYSQL_PREFIX?}_task_system` WHERE `id`=%s LIMIT 1",
                                array(bigintval($ext_id)), __FILE__, __LINE__);
-                       list($subj) = SQL_FETCHROW($result);
+                       list($subject) = SQL_FETCHROW($result);
 
                        // Free result
                        SQL_FREERESULT($result);
 
                        // Disable cache update by default
                        $cache_update = '0';
-                       if (!empty($subj)) {
+                       if (!empty($subject)) {
                                // Extract extension's name from subject...
-                               $ext_name = trim(substr($subj, 1, strpos($subj, ':') - 1));
+                               $ext_name = trim(substr($subject, 1, strpos($subject, ':') - 1));
 
                                // Test the extension for deprecation
                                loadExtension($ext_name, 'test');

diff --git a/inc/modules/admin/what-list_unconfirmed.php b/inc/modules/admin/what-list_unconfirmed.php
index a016dbe6538876daccc33447cc0a1440fa1a2aef..0887f450cde89cbf883d116cdb2b9ae8f77484c8 100644 (file)
--- a/inc/modules/admin/what-list_unconfirmed.php
+++ b/inc/modules/admin/what-list_unconfirmed.php
@@ -98,7 +98,7 @@ if ($listed === true) {
        if (SQL_NUMROWS($result_master) == 1) {
                // Mail order / bonus mail found!
                // @TODO Rewrite this to $content = SQL_FETCHARRAY(), look some lines above for two differrent queries
-               list($stats_id, $sender, $subj, $text, $url, $stamp, $max) = SQL_FETCHROW($result_master);
+               list($stats_id, $sender, $subject, $text, $url, $stamp, $max) = SQL_FETCHROW($result_master);
 
                // Transfer data to constants for the template
                if (($stats_id > 0) && ($ID == '-1')) $ID = $stats_id;
@@ -172,7 +172,7 @@ LIMIT %s",
                // Prepare content
                $content = array(
                        'sender'      => $sender,
-                       'subject'     => $subj,
+                       'subject'     => $subject,
                        'text'        => $text,
                        'url'         => $url,
                        'unconfirmed' => $unconfirmed,

diff --git a/inc/modules/admin/what-repair_lang.php b/inc/modules/admin/what-repair_lang.php
index 378c3e0e6ae1119089a378328b8fe54186f24ece..c62b539465f6a29e37a51ded2b23e47ac51d4f5f 100644 (file)
--- a/inc/modules/admin/what-repair_lang.php
+++ b/inc/modules/admin/what-repair_lang.php
@@ -93,7 +93,7 @@ foreach ($validLanguages as $lang) {
                                if (count($GLOBALS['lang_diff'][$INC]) <= 100) {
                                        // Display them, it is not more than 100 entries difference
                                        foreach ($GLOBALS['lang_diff'][$INC] as $key => $value) {
-                                               $diffContent .= '<li>' . $key . '=' . htmlentities($value) . '</li>';
+                                               $diffContent .= '<li>' . $key . '=' . encodeEntities($value) . '</li>';
                                        } // END - foreach
                                } else {
                                        // To much to display!

diff --git a/inc/wrapper-functions.php b/inc/wrapper-functions.php
index c80742992c6c8cf1e30df82bd64d9a3c3b23b1c0..fdd6be73f4f2ecf713c5ced74d8de4feb2178334 100644 (file)
--- a/inc/wrapper-functions.php
+++ b/inc/wrapper-functions.php
@@ -1061,5 +1061,17 @@ function isValidUserId ($userid) {
        return $GLOBALS['is_valid_userid'][$userid];
 }
 
+// Encodes entities
+function encodeEntities ($str) {
+       // Secure it first
+       $str = secureString($str);
+
+       // Encode dollar sign as well
+       $str = str_replace('$', '$', $str);
+
+       // Return it
+       return $str;
+}
+
 // [EOF]
 ?>

diff --git a/templates/de/html/admin/admin_email_archiv_row.tpl b/templates/de/html/admin/admin_email_archiv_row.tpl
index 2bd5b2e67dcb4f9b4129ed13c076f78a960b07fc..bf64afbcf797a8e4d5ff303cf07579a41e20e263 100644 (file)
--- a/templates/de/html/admin/admin_email_archiv_row.tpl
+++ b/templates/de/html/admin/admin_email_archiv_row.tpl
@@ -5,7 +5,7 @@
        </td>
        <td class="switch_sw$content[sw] bottom right" width="23%" align="center">
                {--EMAIL_SUBJECT--}:<br />
-               <strong class="admin_misc">$content[subject]</strong>
+               <strong class="admin_misc">{%pipe,encodeEntities=$content[subject]%}</strong>
        </td>
        <td class="switch_sw$content[sw] bottom" width="54%" align="center">
                {--EMAIL_TEXT--}:<br />