richard
/
sorbetcms
1
0
Fork 1
Code Issues Pull Requests Releases Wiki Activity

Changed the stripslashes to sql_escape and added this function to mysql_connection.class.php

master
Victor De la Rocha 2008-02-16 18:30:13 +00:00
parent 1fa054c489
commit 5443919c6f
2 changed files with 17 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
classes/functions.php
View File

@ -349,19 +349,7 @@ if(!defined('entry') || !entry) die('Not a valid page');
$dirs = array_unique($dirs);
return $dirs;
}
function sql_escape($value) {
if(get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if( function_exists("mysql_real_escape_string")) {
$value = mysql_real_escape_string($value);
} else {
$value = addslashes($value);
}
return $value;
}
function removeBadTags($source) {
$validTags ='<p><ol><ul><li><a><abbr><acronym><blockquote><code><pre><em><i><strike><s><strong><b><br><span><div><img>';
$source = strip_tags($source, $validTags);

27
classes/mysql_connection.class.php
View File

@ -115,13 +115,10 @@ class Conexion_Mysql {
}
elseif (substr_count(MYSQL_TYPES_DATE, "$tipo_col ")) {
$valor = $this->formatearFecha($valor, $tipo_col); // formatea las fechas
$sqlValues .= "'$valor',";
}
elseif (substr_count(MYSQL_TYPES_STRING, "$tipo_col ")) {
if ($this->auto_slashes) {
$valor = addslashes($valor);
}
$valor = $this->sql_escape($valor);
$sqlValues .= "'$valor',";
}
}
@ -151,7 +148,7 @@ class Conexion_Mysql {
$this->merror = "Debes de pasar un arreglo como parametro.";
return false;
}
$sql = "UPDATE $tabla SET";
foreach ($datos as $llave=>$valor) {
$sql .= " $llave=";
@ -171,9 +168,7 @@ class Conexion_Mysql {
$sql .= "'$valor',";
}
elseif (substr_count(MYSQL_TYPES_STRING, "$tipo_col ")) {
if ($this->auto_slashes) {
$valor = addslashes($valor);
}
$valor = $this->sql_escape($valor);
$sql .= "'$valor',";
}
}
@ -228,8 +223,7 @@ class Conexion_Mysql {
return date('Y-m-d H:i:s', $valor);
*/
}
/**
* Obtiene el registro obtenido de una consulta.
*/
@ -284,6 +278,17 @@ class Conexion_Mysql {
function cierraConexion() {
mysql_free_result($this->mid_consulta);
}
function sql_escape($value) {
if(get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
if( function_exists("mysql_real_escape_string")) {
$value = mysql_real_escape_string($value);
} else {
$value = addslashes($value);
}
return $value;
}
} //fin de la Clase conexion_mysql
?>