Browse Source

Adding database::escape_string

Julio Montoya 15 years ago
parent
commit
503f3885b6
1 changed files with 8 additions and 10 deletions
  1. 8 10
      main/inc/lib/events.lib.inc.php

+ 8 - 10
main/inc/lib/events.lib.inc.php

@@ -1,4 +1,4 @@
-<?php // $Id: events.lib.inc.php 22205 2009-07-17 21:11:52Z cfasanando $
+<?php
 /* See license terms in /license.txt */
 /**
 * EVENTS LIBRARY
@@ -178,7 +178,8 @@ function event_access_tool($tool, $id_session=0)
 	global $_course;
 	global $TABLETRACK_LASTACCESS; //for "what's new" notification
 	
-	$id_session = api_get_session_id();	
+	$id_session = api_get_session_id();
+	$tool = Database::escape_string($tool);	
 	$reallyNow = time();
 	$user_id = $_user['user_id'] ? "'".$_user['user_id']."'" : "0"; // no one
 	// record information
@@ -201,7 +202,7 @@ function event_access_tool($tool, $id_session=0)
 				VALUES
 					(".$user_id.",".// Don't add ' ' around value, it's already done.
 					"'".$_cid."' ,
-					'".htmlspecialchars($tool, ENT_QUOTES)."',
+					'".$tool."',
 					FROM_UNIXTIME(".$reallyNow."), 
 					'".$id_session."')";
 		$res = Database::query($sql);
@@ -209,14 +210,11 @@ function event_access_tool($tool, $id_session=0)
 	// "what's new" notification
 	$sql = "UPDATE $TABLETRACK_LASTACCESS
 			SET access_date = FROM_UNIXTIME($reallyNow)
-			WHERE access_user_id = ".$user_id." AND access_cours_code = '".$_cid."' AND access_tool = '".htmlspecialchars($tool, ENT_QUOTES)."' AND access_session_id=".$id_session;
+			WHERE access_user_id = ".$user_id." AND access_cours_code = '".$_cid."' AND access_tool = '".$tool."' AND access_session_id=".$id_session;
 	$res = Database::query($sql);
-	if (Database::affected_rows() == 0)
-	{
-		$sql = "INSERT INTO $TABLETRACK_LASTACCESS
-					(access_user_id,access_cours_code,access_tool, access_date, access_session_id)
-				VALUES
-					(".$user_id.", '".$_cid."' , '".htmlspecialchars($tool, ENT_QUOTES)."', FROM_UNIXTIME($reallyNow), $id_session)";
+	if (Database::affected_rows() == 0) {
+		$sql = "INSERT INTO $TABLETRACK_LASTACCESS (access_user_id,access_cours_code,access_tool, access_date, access_session_id)
+				VALUES (".$user_id.", '".$_cid."' , '".$tool."', FROM_UNIXTIME($reallyNow), $id_session)";
 		$res = Database::query($sql);
 	}
 	return 1;