tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

BUGFIX Consistently using Convert::raw2sql() instead of DB::getConn()->addslashes() or PHP's deprecated addslashes() for database escaping

Browse Source
This commit is contained in:
Ingo Schommer 2011-09-15 14:40:21 +02:00
parent ca7878453f
commit 6d6c294ae3
12 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/model/ComponentSet.php
View File

@ -129,7 +129,7 @@ class ComponentSet extends DataObjectSet {
$extraSQL = '';
if($extraFields) foreach($extraFields as $k => $v) {
$extraSQL .= ", $k = '" . addslashes($v) . "'";
$extraSQL .= ", $k = '" . Convert::raw2sql($v) . "'";
}
DB::query("INSERT INTO `$this->tableName` SET $parentField = {$this->ownerObj->ID}, $childField = {$item->ID} $extraSQL");

2
core/model/MySQLDatabase.php
View File

@ -290,7 +290,7 @@ class MySQLDatabase extends Database {
}
if($field['Default'] || $field['Default'] === "0") {
$fieldSpec .= " default '" . addslashes($field['Default']) . "'";
$fieldSpec .= " default '" . Convert::raw2sql($field['Default']) . "'";
}
if($field['Extra']) $fieldSpec .= " $field[Extra]";

2
core/model/Versioned.php
View File

@ -273,7 +273,7 @@ class Versioned extends DataObjectDecorator {
// Add any extra, unchanged fields to the version record.
$data = DB::query("SELECT * FROM `$table` WHERE ID = $id")->record();
if($data) foreach($data as $k => $v) {
if (!isset($newManipulation['fields'][$k])) $newManipulation['fields'][$k] = "'" . addslashes($v) . "'";
if (!isset($newManipulation['fields'][$k])) $newManipulation['fields'][$k] = "'" . Convert::raw2sql($v) . "'";
}
// Set up a new entry in (table)_versions

2
core/model/fieldtypes/Boolean.php
View File

@ -64,7 +64,7 @@ class Boolean extends DBField {
} if(!$value || !is_numeric($value)) {
return "0";
} else {
return addslashes($value);
return Convert::raw2sql($value);
}
}

2
core/model/fieldtypes/DBField.php
View File

@ -106,7 +106,7 @@ abstract class DBField extends ViewableData {
if($value === null || $value === "" || $value === false) {
return "null";
} else {
return "'" . addslashes($value) . "'";
return "'" . Convert::raw2sql($value) . "'";
}
}

2
core/model/fieldtypes/Decimal.php
View File

@ -55,7 +55,7 @@ class Decimal extends DBField {
} if(!$value || !is_numeric($value)) {
return "0";
} else {
return addslashes($value);
return Convert::raw2sql($value);
}
}

2
core/model/fieldtypes/Float.php
View File

@ -36,7 +36,7 @@ class Float extends DBField {
} if(!$value || !is_numeric($value)) {
return "0";
} else {
return addslashes($value);
return Convert::raw2sql($value);
}
}

2
core/model/fieldtypes/Int.php
View File

@ -52,7 +52,7 @@ class Int extends DBField {
} if(!$value || !is_numeric($value)) {
return "0";
} else {
return addslashes($value);
return Convert::raw2sql($value);
}
}

2
filesystem/File.php
View File

@ -332,7 +332,7 @@ class File extends DataObject {
$ext = "";
}
$suffix = 1;
while(DataObject::get_one("File", "Name = '" . addslashes($name) . "' AND ParentID = " . (int)$this->ParentID)) {
while(DataObject::get_one("File", "Name = '" . Convert::raw2sql($name) . "' AND ParentID = " . (int)$this->ParentID)) {
$suffix++;
$name = "$base-$suffix$ext";
}

4
filesystem/Folder.php
View File

@ -159,10 +159,10 @@ class Folder extends File {
if(Member::currentUser()) $ownerID = Member::currentUser()->ID;
else $ownerID = 0;
$filename = addslashes($this->Filename . $name);
$filename = Convert::raw2sql($this->Filename . $name);
if($className == 'Folder' ) $filename .= '/';
$name = addslashes($name);
$name = Convert::raw2sql($name);
DB::query("INSERT INTO `File` SET
ClassName = '$className', ParentID = $this->ID, OwnerID = $ownerID,

2
search/AdvancedSearchForm.php
View File

@ -82,7 +82,7 @@ class AdvancedSearchForm extends SearchForm {
foreach($_REQUEST['OnlyShow'] as $section => $checked) {
$items = explode(",", $section);
foreach($items as $item) {
$page = DataObject::get_one('SiteTree', "URLSegment = '" . addslashes($item) . "'");
$page = DataObject::get_one('SiteTree', "URLSegment = '" . Convert::raw2sql($item) . "'");
$pageList[] = $page->ID;
if(!$page) user_error("Can't find a page called '$item'", E_USER_WARNING);
$page->loadDescendantIDListInto($pageList);

2
search/SearchForm.php
View File

@ -174,7 +174,7 @@ class SearchForm extends Form {
public function searchEngine($keywords, $pageLength = null, $sortBy = "Relevance DESC", $extraFilter = "", $booleanSearch = false, $alternativeFileFilter = "", $invertedMatch = false) {
if(!$pageLength) $pageLength = $this->pageLength;
$fileFilter = '';
$keywords = addslashes($keywords);
$keywords = Convert::raw2sql($keywords);
$extraFilters = array('SiteTree' => '', 'File' => '');