Skip to content

Commit 7272e49

Browse files
author
Till Brehm
committed
Improved database library.
1 parent d225421 commit 7272e49

File tree

1 file changed

+17
-23
lines changed

1 file changed

+17
-23
lines changed

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -263,15 +263,9 @@ public function datalogSave($db_table, $action, $primary_field, $primary_id, $re
263263
global $app, $conf;
264264

265265
// Check fields
266-
if(!preg_match('/^[a-zA-Z0-9\.\-\_]{1,64}$/',$db_table)) $app->error('Invalid table name '.$db_table);
266+
if(!preg_match('/^[a-zA-Z0-9\-\_\.]{1,64}$/',$db_table)) $app->error('Invalid table name '.$db_table);
267267
if(!preg_match('/^[a-zA-Z0-9\-\_]{1,64}$/',$primary_field)) $app->error('Invalid primary field '.$primary_field.' in table '.$db_table);
268268

269-
if(strpos($db_table, '.') !== false) {
270-
$db_table = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $db_table);
271-
} else {
272-
$db_table = '`' . $db_table . '`';
273-
}
274-
275269
$primary_field = $this->quote($primary_field);
276270
$primary_id = intval($primary_id);
277271

@@ -314,13 +308,13 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
314308
global $app;
315309

316310
// Check fields
317-
if(!preg_match('/^[a-zA-Z0-9\.\-\_]{1,64}$/',$tablename)) $app->error('Invalid table name '.$tablename);
311+
if(!preg_match('/^[a-zA-Z0-9\-\_\.]{1,64}$/',$tablename)) $app->error('Invalid table name '.$tablename);
318312
if(!preg_match('/^[a-zA-Z0-9\-\_]{1,64}$/',$index_field)) $app->error('Invalid index field '.$index_field.' in table '.$tablename);
319313

320314
if(strpos($tablename, '.') !== false) {
321-
$tablename = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $tablename);
315+
$tablename_escaped = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $tablename);
322316
} else {
323-
$tablename = '`' . $tablename . '`';
317+
$tablename_escaped = '`' . $tablename . '`';
324318
}
325319

326320
$index_field = $this->quote($index_field);
@@ -340,9 +334,9 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
340334
}
341335

342336
$old_rec = array();
343-
$this->query("INSERT INTO $tablename $insert_data_str");
337+
$this->query("INSERT INTO $tablename_escaped $insert_data_str");
344338
$index_value = $this->insertID();
345-
$new_rec = $this->queryOneRecord("SELECT * FROM $tablename WHERE $index_field = '$index_value'");
339+
$new_rec = $this->queryOneRecord("SELECT * FROM $tablename_escaped WHERE $index_field = '$index_value'");
346340
$this->datalogSave($tablename, 'INSERT', $index_field, $index_value, $old_rec, $new_rec);
347341

348342
return $index_value;
@@ -353,19 +347,19 @@ public function datalogUpdate($tablename, $update_data, $index_field, $index_val
353347
global $app;
354348

355349
// Check fields
356-
if(!preg_match('/^[a-zA-Z0-9\.\-\_]{1,64}$/',$tablename)) $app->error('Invalid table name '.$tablename);
350+
if(!preg_match('/^[a-zA-Z0-9\-\_\.]{1,64}$/',$tablename)) $app->error('Invalid table name '.$tablename);
357351
if(!preg_match('/^[a-zA-Z0-9\-\_]{1,64}$/',$index_field)) $app->error('Invalid index field '.$index_field.' in table '.$tablename);
358352

359353
if(strpos($tablename, '.') !== false) {
360-
$tablename = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $tablename);
354+
$tablename_escaped = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $tablename);
361355
} else {
362-
$tablename = '`' . $tablename . '`';
356+
$tablename_escaped = '`' . $tablename . '`';
363357
}
364358

365359
$index_field = $this->quote($index_field);
366360
$index_value = $this->quote($index_value);
367361

368-
$old_rec = $this->queryOneRecord("SELECT * FROM $tablename WHERE $index_field = '$index_value'");
362+
$old_rec = $this->queryOneRecord("SELECT * FROM $tablename_escaped WHERE $index_field = '$index_value'");
369363

370364
if(is_array($update_data)) {
371365
$update_data_str = '';
@@ -377,8 +371,8 @@ public function datalogUpdate($tablename, $update_data, $index_field, $index_val
377371
$update_data_str = $update_data;
378372
}
379373

380-
$this->query("UPDATE $tablename SET $update_data_str WHERE $index_field = '$index_value'");
381-
$new_rec = $this->queryOneRecord("SELECT * FROM $tablename WHERE $index_field = '$index_value'");
374+
$this->query("UPDATE $tablename_escaped SET $update_data_str WHERE $index_field = '$index_value'");
375+
$new_rec = $this->queryOneRecord("SELECT * FROM $tablename_escaped WHERE $index_field = '$index_value'");
382376
$this->datalogSave($tablename, 'UPDATE', $index_field, $index_value, $old_rec, $new_rec, $force_update);
383377

384378
return true;
@@ -389,20 +383,20 @@ public function datalogDelete($tablename, $index_field, $index_value) {
389383
global $app;
390384

391385
// Check fields
392-
if(!preg_match('/^[a-zA-Z0-9\.\-\_]{1,64}$/',$tablename)) $app->error('Invalid table name '.$tablename);
386+
if(!preg_match('/^[a-zA-Z0-9\-\_\.]{1,64}$/',$tablename)) $app->error('Invalid table name '.$tablename);
393387
if(!preg_match('/^[a-zA-Z0-9\-\_]{1,64}$/',$index_field)) $app->error('Invalid index field '.$index_field.' in table '.$tablename);
394388

395389
if(strpos($tablename, '.') !== false) {
396-
$tablename = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $tablename);
390+
$tablename_escaped = preg_replace('/^(.+)\.(.+)$/', '`$1`.`$2`', $tablename);
397391
} else {
398-
$tablename = '`' . $tablename . '`';
392+
$tablename_escaped = '`' . $tablename . '`';
399393
}
400394

401395
$index_field = $this->quote($index_field);
402396
$index_value = $this->quote($index_value);
403397

404-
$old_rec = $this->queryOneRecord("SELECT * FROM $tablename WHERE $index_field = '$index_value'");
405-
$this->query("DELETE FROM $tablename WHERE $index_field = '$index_value'");
398+
$old_rec = $this->queryOneRecord("SELECT * FROM $tablename_escaped WHERE $index_field = '$index_value'");
399+
$this->query("DELETE FROM $tablename_escaped WHERE $index_field = '$index_value'");
406400
$new_rec = array();
407401
$this->datalogSave($tablename, 'DELETE', $index_field, $index_value, $old_rec, $new_rec);
408402

0 commit comments

Comments
 (0)