From 35b2973c5ed7fbba047cf67a5e84957bfdedc7c7 Mon Sep 17 00:00:00 2001
From: Jason Woofenden <jason@jasonwoof.com>
Date: Thu, 14 Aug 2014 15:38:03 -0400
Subject: [PATCH 1/1] db: use utf8 for client encoding, use real_escape

---
 db.php |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/db.php b/db.php
index b1faf2c..84b23aa 100644
--- a/db.php
+++ b/db.php
@@ -38,7 +38,11 @@ require_once(__DIR__ . '/format.php');
 #   the database connection handle. You'll only need this if you want to have
 #   multiple databases open at once.
 
-function db_connect($database = 'auto', $user = 'auto', $pass = 'auto', $host = 'localhost') {
+function db_enc_sql($str) {
+	return mysql_real_escape_string($str, $GLOBALS['wfpl_db_handle'] ? $GLOBALS['wfpl_db_handle'] : null);
+}
+
+function db_connect($database = 'auto', $user = 'auto', $pass = 'auto', $host = 'localhost', $encoding = 'utf8') {
 	if($database == 'auto') {
 		if(isset($GLOBALS['db_name'])) {
 			$database = $GLOBALS['db_name'];
@@ -72,6 +76,8 @@ function db_connect($database = 'auto', $user = 'auto', $pass = 'auto', $host =
 		die('Could not connect to the database: ' . mysql_error());
 	}
 
+	mysql_set_charset($encoding, $GLOBALS['wfpl_db_handle']);
+
 	if(!mysql_select_db($database, $GLOBALS['wfpl_db_handle'])) {
 		die("Couldn not access database \"$database\": " . mysql_error($GLOBALS['wfpl_db_handle']));
 	}
@@ -127,9 +133,9 @@ function _db_printf($str, $args) {
 		$str = substr($str, $pos + 2);
 
 		if($chr == '"') {
-			$out .= '"' . enc_sql(array_shift($args)) . '"';
+			$out .= '"' . db_enc_sql(array_shift($args)) . '"';
 		} elseif($chr == 's') {
-			$out .= enc_sql(array_shift($args));
+			$out .= db_enc_sql(array_shift($args));
 		} elseif($chr == 'i') {
 			$int = format_int(array_shift($args));
 			if($int == '') $int = '0';
@@ -308,7 +314,7 @@ function db_insert_ish($command, $table, $columns, $values) {
 	$sql = '';
 	foreach($values as $value) {
 		if($sql) $sql .= ',';
-		$sql .= '"' . enc_sql($value) . '"';
+		$sql .= '"' . db_enc_sql($value) . '"';
 	}
 
 	$sql = "$command INTO $table ($columns) values($sql)";
@@ -358,7 +364,7 @@ function db_update($table, $columns, $values) {
 		if($sql != '') {
 			$sql .= ', ';
 		}
-		$sql .= $columns[$i] . ' = "' . enc_sql($values[$i]) . '"';
+		$sql .= $columns[$i] . ' = "' . db_enc_sql($values[$i]) . '"';
 	}
 
 
-- 
1.7.10.4