From 35b2973c5ed7fbba047cf67a5e84957bfdedc7c7 Mon Sep 17 00:00:00 2001 From: Jason Woofenden Date: Thu, 14 Aug 2014 15:38:03 -0400 Subject: [PATCH 1/1] db: use utf8 for client encoding, use real_escape --- db.php | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/db.php b/db.php index b1faf2c..84b23aa 100644 --- a/db.php +++ b/db.php @@ -38,7 +38,11 @@ require_once(__DIR__ . '/format.php'); # the database connection handle. You'll only need this if you want to have # multiple databases open at once. -function db_connect($database = 'auto', $user = 'auto', $pass = 'auto', $host = 'localhost') { +function db_enc_sql($str) { + return mysql_real_escape_string($str, $GLOBALS['wfpl_db_handle'] ? $GLOBALS['wfpl_db_handle'] : null); +} + +function db_connect($database = 'auto', $user = 'auto', $pass = 'auto', $host = 'localhost', $encoding = 'utf8') { if($database == 'auto') { if(isset($GLOBALS['db_name'])) { $database = $GLOBALS['db_name']; @@ -72,6 +76,8 @@ function db_connect($database = 'auto', $user = 'auto', $pass = 'auto', $host = die('Could not connect to the database: ' . mysql_error()); } + mysql_set_charset($encoding, $GLOBALS['wfpl_db_handle']); + if(!mysql_select_db($database, $GLOBALS['wfpl_db_handle'])) { die("Couldn not access database \"$database\": " . mysql_error($GLOBALS['wfpl_db_handle'])); } @@ -127,9 +133,9 @@ function _db_printf($str, $args) { $str = substr($str, $pos + 2); if($chr == '"') { - $out .= '"' . enc_sql(array_shift($args)) . '"'; + $out .= '"' . db_enc_sql(array_shift($args)) . '"'; } elseif($chr == 's') { - $out .= enc_sql(array_shift($args)); + $out .= db_enc_sql(array_shift($args)); } elseif($chr == 'i') { $int = format_int(array_shift($args)); if($int == '') $int = '0'; @@ -308,7 +314,7 @@ function db_insert_ish($command, $table, $columns, $values) { $sql = ''; foreach($values as $value) { if($sql) $sql .= ','; - $sql .= '"' . enc_sql($value) . '"'; + $sql .= '"' . db_enc_sql($value) . '"'; } $sql = "$command INTO $table ($columns) values($sql)"; @@ -358,7 +364,7 @@ function db_update($table, $columns, $values) { if($sql != '') { $sql .= ', '; } - $sql .= $columns[$i] . ' = "' . enc_sql($values[$i]) . '"'; + $sql .= $columns[$i] . ' = "' . db_enc_sql($values[$i]) . '"'; } -- 1.7.10.4