Selaa lähdekoodia

Minor - Using Database :: escape_string instead of this->escape_string

Julio Montoya 12 vuotta sitten
vanhempi
commit
bd38dccabd
1 muutettua tiedostoa jossa 37 lisäystä ja 38 poistoa
  1. 37 38
      main/newscorm/learnpath.class.php

+ 37 - 38
main/newscorm/learnpath.class.php

@@ -100,7 +100,7 @@ class learnpath {
             return false;
         } else {
             $main_table = Database::get_main_table(TABLE_MAIN_COURSE);
-            $course = $this->escape_string($course);
+            $course = Database::escape_string($course);
             $sql = "SELECT * FROM $main_table WHERE code = '$course'";
             if ($this->debug > 2) { error_log('New LP - learnpath::__construct() '.__LINE__.' - Querying course: '.$sql, 0); }
             $res = Database::query($sql);
@@ -377,14 +377,14 @@ class learnpath {
 
         $parent = intval($parent);
         $previous = intval($previous);
-        $type = $this->escape_string($type);
+        $type = Database::escape_string($type);
         $id = intval($id);
-        $max_time_allowed = $this->escape_string(htmlentities($max_time_allowed));
+        $max_time_allowed = Database::escape_string(htmlentities($max_time_allowed));
         if (empty ($max_time_allowed)) {
             $max_time_allowed = 0;
         }
-        $title       = $this->escape_string($title);
-        $description = $this->escape_string($description);
+        $title       = Database::escape_string($title);
+        $description = Database::escape_string($description);
         $sql_count = "	SELECT COUNT(id) AS num
                         FROM $tbl_lp_item
                         WHERE c_id = $course_id AND lp_id = " . $this->get_id() . " AND parent_item_id = " . $parent;
@@ -428,7 +428,7 @@ class learnpath {
         }
 
         $new_item_id = -1;
-        $id = $this->escape_string($id);
+        $id = Database::escape_string($id);
 
         if ($type == 'quiz') {
             $sql = 'SELECT SUM(ponderation)
@@ -583,7 +583,7 @@ class learnpath {
             $file = $file_components[count($file_components) - 1];
 
             // Store the mp3 file in the lp_item table.
-            $sql_insert_audio = "UPDATE $tbl_lp_item SET audio = '" . Database :: escape_string($file) . "' WHERE id = '" . Database :: escape_string($new_item_id) . "'";
+            $sql_insert_audio = "UPDATE $tbl_lp_item SET audio = '" . Database::escape_string($file) . "' WHERE id = '" . Database::escape_string($new_item_id) . "'";
             Database::query($sql_insert_audio);
         }
         return $new_item_id;
@@ -1080,7 +1080,7 @@ class learnpath {
                 $path = handle_uploaded_document($c_det, $audio, $bp, '/audio', api_get_user_id(), 0, null, '', 0, 'rename', false, 0);
                 $path = substr($path, 7);
                 // Update reference in lp_item - audio path is the path from inside de document/audio/ dir.
-                $audio_update_sql = ", audio = '" . Database :: escape_string($path) . "' ";
+                $audio_update_sql = ", audio = '" . Database::escape_string($path) . "' ";
             }
         }
 
@@ -1091,11 +1091,11 @@ class learnpath {
         if ($same_parent && $same_previous) {
             // Only update title and description.
             $sql_update = " UPDATE " . $tbl_lp_item . "
-                            SET title = '" . $this->escape_string($title) . "',
+                            SET title = '" . Database::escape_string($title) . "',
                                 prerequisite = '" . $prerequisites . "',
-                                description = '" . $this->escape_string($description) . "'
+                                description = '" . Database::escape_string($description) . "'
                                 " . $audio_update_sql . ",
-                                max_time_allowed = '" . $this->escape_string($max_time_allowed) . "'
+                                max_time_allowed = '" . Database::escape_string($max_time_allowed) . "'
                             WHERE c_id = ".$course_id." AND id = " . $id;
             $res_update = Database::query($sql_update);
         } else {
@@ -1193,8 +1193,8 @@ class learnpath {
             // Update the current item with the new data.
             $sql_update = "UPDATE " . $tbl_lp_item . "
                             SET
-                                title = '" . $this->escape_string($title) . "',
-                                description = '" . $this->escape_string($description) . "',
+                                title = '" . Database::escape_string($title) . "',
+                                description = '" . Database::escape_string($description) . "',
                                 parent_item_id = " . $parent . ",
                                 previous_item_id = " . $previous . ",
                                 next_item_id = " . $new_next . ",
@@ -1274,7 +1274,7 @@ class learnpath {
             return false;
         }
 
-        $prerequisite_id = $this->escape_string($prerequisite_id);
+        $prerequisite_id = Database::escape_string($prerequisite_id);
 
         $tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM);
 
@@ -1312,7 +1312,7 @@ class learnpath {
      */
     public function escape_string($string) {
         //if ($this->debug > 0) { error_log('New LP - In learnpath::escape_string('.$string.')', 0); }
-        return Database :: escape_string($string);
+        return Database::escape_string($string);
     }
 
     /**
@@ -1604,7 +1604,7 @@ class learnpath {
         }
 
         $info = '';
-        $item_id = $this->escape_string($item_id);
+        $item_id = Database::escape_string($item_id);
 
         if (!empty($item_id) && is_object($this->items[$item_id])) {
             //if item is defined, return values from DB
@@ -2992,8 +2992,8 @@ class learnpath {
                             }
 
                             if ($type_quiz) {
-                                $lp_item_id = Database :: escape_string($lp_item_id);
-                                $lp_view_id = Database :: escape_string($lp_view_id);
+                                $lp_item_id = Database::escape_string($lp_item_id);
+                                $lp_view_id = Database::escape_string($lp_view_id);
                                 $sql = "SELECT count(*) FROM $lp_item_view_table
                                         WHERE c_id = $course_id AND lp_item_id='" . (int) $lp_item_id . "' AND lp_view_id ='" . (int) $lp_view_id . "' AND status='completed'";
                                 $result = Database::query($sql);
@@ -3739,7 +3739,7 @@ class learnpath {
         // TODO: Do a better check on the index pointing to the right item (it is supposed to be working
         // on $ordered_items[] but not sure it's always safe to use with $items[]).
         if (empty ($item_id)) {
-            $item_id = $this->escape_string($_REQUEST['id']);
+            $item_id = Database::escape_string($_REQUEST['id']);
         }
         if (empty ($item_id)) {
             $item_id = $this->get_current_item_id();
@@ -3812,7 +3812,7 @@ class learnpath {
                 error_log('New LP - New current item given is ' . $item_id . '...', 0);
             }
             if (is_numeric($item_id)) {
-                $item_id = $this->escape_string($item_id);
+                $item_id = Database::escape_string($item_id);
                 // TODO: Check in database here.
                 $this->last = $this->current;
                 $this->current = $item_id;
@@ -3921,7 +3921,7 @@ class learnpath {
         }
         if (empty ($name))
             return false;
-        $this->maker = $this->escape_string($name);
+        $this->maker = Database::escape_string($name);
         $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
         $course_id = api_get_course_int_id();
         $lp_id = $this->get_id();
@@ -3945,7 +3945,7 @@ class learnpath {
         if (empty ($name))
             return false;
 
-        $this->name = $this->escape_string($name);
+        $this->name = Database::escape_string($name);
         $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
         $lp_id = $this->get_id();
         $course_id = api_get_course_int_id();
@@ -4055,7 +4055,7 @@ class learnpath {
         if ($this->debug > 0) {
             error_log('New LP - In learnpath::set_theme()', 0);
         }
-        $this->theme = $this->escape_string($name);
+        $this->theme = Database::escape_string($name);
         $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
         $lp_id = $this->get_id();
         $sql = "UPDATE $lp_table SET theme = '" . $this->theme . "' WHERE c_id = ".$course_id." AND id = '$lp_id'";
@@ -4078,7 +4078,7 @@ class learnpath {
             error_log('New LP - In learnpath::set_preview_image()', 0);
         }
 
-        $this->preview_image = $this->escape_string($name);
+        $this->preview_image = Database::escape_string($name);
         $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
         $lp_id = $this->get_id();
         $sql = "UPDATE $lp_table SET preview_image = '" . $this->preview_image . "' WHERE c_id = ".$course_id." AND id = '$lp_id'";
@@ -4099,7 +4099,7 @@ class learnpath {
         if ($this->debug > 0) {
             error_log('New LP - In learnpath::set_author()', 0);
         }
-        $this->author = $this->escape_string($name);
+        $this->author = Database::escape_string($name);
         $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
         $lp_id = $this->get_id();
         $sql = "UPDATE $lp_table SET author = '" . $this->author . "' WHERE c_id = ".$course_id." AND id = '$lp_id'";
@@ -4170,7 +4170,7 @@ class learnpath {
         if (empty ($name))
             return false;
 
-        $this->proximity = $this->escape_string($name);
+        $this->proximity = Database::escape_string($name);
         $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
         $lp_id = $this->get_id();
         $sql = "UPDATE $lp_table SET content_local = '" . $this->proximity . "'
@@ -4229,7 +4229,7 @@ class learnpath {
         }
 
         if (!empty($expired_on)) {
-            $this->expired_on = $this->escape_string(api_get_utc_datetime($expired_on));
+            $this->expired_on = Database::escape_string(api_get_utc_datetime($expired_on));
         } else {
             $this->expired_on = '';
         }
@@ -4243,7 +4243,6 @@ class learnpath {
         return true;
     }
 
-
     /**
      * Sets and saves the publicated_on date
      * @param   string  Optional string giving the new author of this learnpath
@@ -4255,7 +4254,7 @@ class learnpath {
             error_log('New LP - In learnpath::set_expired_on()', 0);
         }
         if (!empty($publicated_on)) {
-            $this->publicated_on = $this->escape_string(api_get_utc_datetime($publicated_on));
+            $this->publicated_on = Database::escape_string(api_get_utc_datetime($publicated_on));
         } else {
             $this->publicated_on = '';
         }
@@ -5248,7 +5247,7 @@ class learnpath {
 
         $sql = " SELECT id, title, description, item_type, path, parent_item_id, previous_item_id, next_item_id, max_score, min_score, mastery_score, display_order
                  FROM $tbl_lp_item
-                 WHERE c_id = ".$course_id." AND lp_id = " . Database :: escape_string($this->lp_id);
+                 WHERE c_id = ".$course_id." AND lp_id = " . Database::escape_string($this->lp_id);
         $result = Database::query($sql);
         $arrLP = array ();
 
@@ -5421,7 +5420,7 @@ class learnpath {
                         if ($new_comment)
                             $ct .= ", comment='" . Database::escape_string($new_comment). "'";
                         if ($new_title)
-                            $ct .= ", title='" . Database :: escape_string(htmlspecialchars($new_title, ENT_QUOTES, $charset))."' ";
+                            $ct .= ", title='" . Database::escape_string(htmlspecialchars($new_title, ENT_QUOTES, $charset))."' ";
 
                         $sql_update = "UPDATE " . $tbl_doc ." SET " . substr($ct, 1)." WHERE c_id = ".$course_id." AND id = " . $document_id;
                         Database::query($sql_update);
@@ -5502,7 +5501,7 @@ class learnpath {
             $tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM);
             $tbl_doc     = Database :: get_course_table(TABLE_DOCUMENT);
             $sql = "SELECT lp.* FROM " . $tbl_lp_item . " as lp
-                    WHERE c_id = ".$course_id." AND lp.id = " . Database :: escape_string($item_id);
+                    WHERE c_id = ".$course_id." AND lp.id = " . Database::escape_string($item_id);
             $result = Database::query($sql);
             while ($row = Database :: fetch_array($result,'ASSOC')) {
                 $_SESSION['parent_item_id'] = ($row['item_type'] == 'dokeos_chapter' || $row['item_type'] == 'dokeos_module' || $row['item_type'] == 'dir') ? $item_id : 0;
@@ -5530,7 +5529,7 @@ class learnpath {
                         break;
                     case TOOL_DOCUMENT:
                         $tbl_doc      = Database :: get_course_table(TABLE_DOCUMENT);
-                        $sql_doc      = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($row['path']);
+                        $sql_doc      = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database::escape_string($row['path']);
                         $result       = Database::query($sql_doc);
                         $path_file    = Database::result($result, 0, 0);
                         $path_parts   = pathinfo($path_file);
@@ -5568,7 +5567,7 @@ class learnpath {
         $return = '';
         if (is_numeric($item_id)) {
             $tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM);
-            $sql = "SELECT * FROM $tbl_lp_item WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($item_id);
+            $sql = "SELECT * FROM $tbl_lp_item WHERE c_id = ".$course_id." AND id = " . Database::escape_string($item_id);
             $res = Database::query($sql);
             $row = Database::fetch_array($res);
 
@@ -5591,7 +5590,7 @@ class learnpath {
                                     LEFT JOIN " . $tbl_doc . " as doc ON doc.id = lp.path
                                     WHERE 	lp.c_id = $course_id AND
                     						doc.c_id = $course_id AND
-                    						lp.id = " . Database :: escape_string($item_id);
+                    						lp.id = " . Database::escape_string($item_id);
                     $res_step = Database::query($sql_step);
                     $row_step = Database :: fetch_array($res_step);
                     $return .= $this->display_manipulate($item_id, $row['item_type']);
@@ -5601,7 +5600,7 @@ class learnpath {
                     $link_id = (string) $row['path'];
                     if (ctype_digit($link_id)) {
                         $tbl_link = Database :: get_course_table(TABLE_LINK);
-                        $sql_select = 'SELECT url FROM ' . $tbl_link . ' WHERE c_id = '.$course_id.' AND id = ' . Database :: escape_string($link_id);
+                        $sql_select = 'SELECT url FROM ' . $tbl_link . ' WHERE c_id = '.$course_id.' AND id = ' . Database::escape_string($link_id);
                         $res_link = Database::query($sql_select);
                         $row_link = Database :: fetch_array($res_link);
                         if (is_array($row_link)) {
@@ -6773,7 +6772,7 @@ class learnpath {
         // We don't display the document form if it's not an editable document (html or txt file).
         if ($action == "add") {
             if (is_numeric($extra_info)) {
-                $sql_doc = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($extra_info);
+                $sql_doc = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database::escape_string($extra_info);
                 $result = Database::query($sql_doc);
                 $path_file = Database :: result($result, 0, 0);
                 $path_parts = pathinfo($path_file);
@@ -6792,7 +6791,7 @@ class learnpath {
             }
         } elseif (is_numeric($extra_info)) {
             $sql_doc = "SELECT path, title FROM " . $tbl_doc . "
-                        WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($extra_info);
+                        WHERE c_id = ".$course_id." AND id = " . Database::escape_string($extra_info);
 
             $result = Database::query($sql_doc);
             $row 	= Database::fetch_array($result);