Changeset 7802

Timestamp:

06/08/09 00:13:25 (4 years ago)

Author:

xrobau

Message:

php-sqlite3 hurts my brain.

Files:

• modules/branches/2.6/core/agi-bin/sql.php (modified) (12 diffs)

modules/branches/2.6/core/agi-bin/sql.php

@@ -1 @@
-
+
+
+
-
-// SQL Abstraction Layer for AGI Applications
@@ -35 +37 @@
-//  $db = new AGIDB($AGI);
-//
+//  $result = $db->escape($sql)
+//  Escapes any characters that could confuse the database and lead to SQL injection problems.
+//  You should use this on ANY browser-supplied or user-supplied input.
+//  
-//  $result = $db->sql($sql, $type)
-//  Returns the result of the SQL command $sql.  This will die noisily if you 
@@ -82 +88 @@
-
-if (!class_exists('AGI')) {
-
+
+
+
+
+
+
+
+
-} 
-
@@ -114 +127 @@
-  public $dbhandle; 
-
-
+=null
-  // This gets called when 'new AGIDB(..)' is run.
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-  // Don't connect to the database on startup, as you want the AGI
-  // to be up and running as fast as possible. Connect on the first
@@ -227 +252 @@
-    case "NUM":
-    case "BOTH":
+    case "NONE":
-      break;
-    default:
@@ -250 +276 @@
-      $this->numrows = mysql_num_rows($res);
-      // Return the correct type.
+      if ($type == "NONE") {
+        return true;
+      }
-      for ($i = 0; $i <= $this->numrows; $i++) {
-        if ($type == "NUM") {
@@ -271 +300 @@
-      $this->numrows = sqlite_num_rows($res);
-      // Return the correct type.
+      if ($type == "NONE") {
+        return true;
+      }
-      if ($type == "NUM") {
-        $sqlresult = sqlite_fetch_all($res, SQLITE_NUM);
@@ -289 +321 @@
-      $sql3holderRowNbr = 0;
-
+      // If no result is required, just run the query and return the status.
+      if ($type == "NONE") {
+        $res = sqlite3_exec($this->dbhandle, $result);
+        if (!$res) {
+          $this->errstr = $result;
+          return false;
+        } else {
+          $this->errstr = null;
+          return true;
+        }
+      }
-      // This next line uses the sqlite3_hack function, below, to load
-      // up the $sql3holder variables.
@@ -295 +338 @@
-      $this->debug("SQL returned $sql3holderRowNbr Rows", 4);
-      if ($sql3holderRowNbr == 0) {
-null
+true
-      }
-      if ($type == "NUM") {
@@ -305 +348 @@
-      }
-    default:
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-  function get_var($value) {
-        $r = $this->agi->get_variable( $value );
@@ -320 +403 @@
-  }
-
+  function sql_check($sql) {
+  // Anything starting with ALTER is right out. 
+  if (preg_match('/^ALTER/', $sql)) {
+    $this->debug("SEVERE PROGRAMMING ERROR: Do not use ALTER in SQL Queries. ".
+      "Use SQL Class functions. ABORTING.", 0);
+    exit;
+  }
+  // Make sure that at least one pair of backticks has been found.
+  if (!preg_match('/\`.+\`/', $sql)) {
+    $this->debug("SEVERE PROGRAMMING ERROR: For portability, COLUMNS must be ".
+      "surrounded by BACK TICKS (`), yet none were found. Continuing.", 0);
+  }
+  if (!preg_match('/\'.+\'/', $sql)) {
+    $this->debug("SEVERE PROGRAMMING ERROR: For portability, FIELDS must be ".
+      "surrounded by SINGLE QUOTES ('), yet none were found. Continuing.", 0);
+  }
+  return $sql;
+  }
+
+  // Escape magic characters that are important to databases
+  function escape($str) {
+  // Ensure we're connected to the database.
+  if ($this->dbhandle == null) {
+    $this->dbhandle = $this->sql_database_connect();
+  }
+  if ($this->dbhandle == null) {
+    // We didn't get a valid handle after the connect, so fail.
+    $this->debug('SEVERE: Unable to connect to database.', 1);
+    return false;
+  }
+  switch ($this->db) {
+    case "mysql":
+      return mysql_real_escape_string($str, $this->dbhandle);
+    case "sqlite":
+      return sqlite_escape_string($str);
+    case "sqlite3":
+      // SQLite only needs to care about single ticks - "'". Escape
+      // that with another tick.
+      return str_replace("'", "''", $str);
+    default:
+      $this->debug("SEVERE: Database type '".$this->db."' NOT SUPPORTED (escape)", 0);
+      return false;
+  }
+  }
+  
-  function debug($string, $level=3) {
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-}
@@ -343 +473 @@
-  // Don't uncomment this unless you don't care about anything that
-  // happens after this - phpagi WILL get confused.
-
-  // print "VERBOSE sqlite3_hack called 4\n";
+
-  $i = 0;
-  foreach ($data as $x) {