From 5443919c6fb60a66b5f5e411b2112d8e544f5d5b Mon Sep 17 00:00:00 2001
From: Victor De la Rocha <vyk2rr@gmail.com>
Date: Sat, 16 Feb 2008 18:30:13 +0000
Subject: [PATCH] Changed the stripslashes to sql_escape and added this
 function to mysql_connection.class.php

---
 classes/functions.php              | 14 +-------------
 classes/mysql_connection.class.php | 27 ++++++++++++++++-----------
 2 files changed, 17 insertions(+), 24 deletions(-)

diff --git a/classes/functions.php b/classes/functions.php
index 8422455..1fd2f16 100644
--- a/classes/functions.php
+++ b/classes/functions.php
@@ -349,19 +349,7 @@ if(!defined('entry') || !entry) die('Not a valid page');
 		$dirs = array_unique($dirs);
  		return $dirs;
  	}
-	
-	function sql_escape($value) {
-	    if(get_magic_quotes_gpc()) {
-	          $value = stripslashes($value);
-	    }
-	    if( function_exists("mysql_real_escape_string")) {
-	          $value = mysql_real_escape_string($value);
-	    } else {
-	          $value = addslashes($value);
-	    }
-	    return $value;
-	}
-	
+
 	function removeBadTags($source) {
 		$validTags ='<p><ol><ul><li><a><abbr><acronym><blockquote><code><pre><em><i><strike><s><strong><b><br><span><div><img>';
 		$source = strip_tags($source, $validTags);
diff --git a/classes/mysql_connection.class.php b/classes/mysql_connection.class.php
index dc59daf..9def573 100644
--- a/classes/mysql_connection.class.php
+++ b/classes/mysql_connection.class.php
@@ -115,13 +115,10 @@ class Conexion_Mysql {
 		 }
 		 elseif (substr_count(MYSQL_TYPES_DATE, "$tipo_col ")) {
 			$valor = $this->formatearFecha($valor, $tipo_col); // formatea las fechas
-			
 			$sqlValues .= "'$valor',";
 		 }
 		 elseif (substr_count(MYSQL_TYPES_STRING, "$tipo_col ")) {
-			if ($this->auto_slashes) {
-				$valor = addslashes($valor);
-			}
+			$valor = $this->sql_escape($valor);
 			$sqlValues .= "'$valor',";  
 		 }
 	  }
@@ -151,7 +148,7 @@ class Conexion_Mysql {
 			$this->merror = "Debes de pasar un arreglo como parametro.";
 			return false;
 		}
-		  
+
 		$sql = "UPDATE $tabla SET";
 		foreach ($datos as $llave=>$valor) {
 			$sql .= " $llave=";
@@ -171,9 +168,7 @@ class Conexion_Mysql {
 			$sql .= "'$valor',";
 			}
 			elseif (substr_count(MYSQL_TYPES_STRING, "$tipo_col ")) {
-			if ($this->auto_slashes) {
-				$valor = addslashes($valor);
-			}
+			$valor = $this->sql_escape($valor);
 			$sql .= "'$valor',";  
 			}	
 		}
@@ -228,8 +223,7 @@ class Conexion_Mysql {
 	  return date('Y-m-d H:i:s', $valor);
 	*/
 	}	
-	
-	
+
 	/**
 	 * Obtiene el registro obtenido de una consulta.
 	 */
@@ -284,6 +278,17 @@ class Conexion_Mysql {
 	function cierraConexion() {
 		mysql_free_result($this->mid_consulta);
 	}
-	
+
+	function sql_escape($value) {
+	    if(get_magic_quotes_gpc()) {
+	          $value = stripslashes($value);
+	    }
+	    if( function_exists("mysql_real_escape_string")) {
+	          $value = mysql_real_escape_string($value);
+	    } else {
+	          $value = addslashes($value);
+	    }
+	    return $value;
+	}	
 } //fin de la Clase conexion_mysql
 ?>
\ No newline at end of file