From 6f4fe7ed0696463703394cfe37403773c23e2ad4 Mon Sep 17 00:00:00 2001
From: Ian Campbell <ijc@hellion.org.uk>
Date: Tue, 19 Jul 2016 20:01:32 +0100
Subject: [PATCH] Avoid double quoting SQL
$db->escape already wraps the result in 's so there is no need to do it in the
caller.
This is a little complicated in searchMusic since the %'s need to be inside the
quoting but we do not want them to be escaped themselves. Concat them with the
search term using a SQL CONCAT().
---
modules/music/mp3act_functions.php | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/modules/music/mp3act_functions.php b/modules/music/mp3act_functions.php
index b6fc7e0..9d2780c 100644
|
a
|
b
|
function GarbageCollector() |
| 33 | 33 | if (0 == mt_rand(0, 30)) |
| 34 | 34 | { |
| 35 | 35 | $query = 'DELETE FROM music_playlists '. |
| 36 | | "WHERE playlist_name='".$db->escape('MythWeb Temporary Playlist')."'". |
| | 36 | "WHERE playlist_name=".$db->escape('MythWeb Temporary Playlist'). |
| 37 | 37 | ' AND (NOW() - last_accessed) > ('.MYTH_PLAYLIST_SAVE_TIME.');'; |
| 38 | 38 | $sh = $db->query($query); |
| 39 | 39 | $sh->finish(); |
| … |
… |
function buildBreadcrumb($page, $parent, $parentitem, $child, $childitem) |
| 217 | 217 | function musicLookup($type, $itemid) |
| 218 | 218 | { |
| 219 | 219 | global $db; |
| 220 | | $sql_itemid = "'".$db->escape($itemid)."'"; |
| | 220 | $sql_itemid = $db->escape($itemid); |
| 221 | 221 | switch($type) |
| 222 | 222 | { |
| 223 | 223 | case 'browse': |
| … |
… |
function musicLookup($type, $itemid) |
| 279 | 279 | "FROM music_artists " . |
| 280 | 280 | "GROUP BY artist_name_sort " . |
| 281 | 281 | "HAVING artist_name_sort " . |
| 282 | | "LIKE '" . $db->escape($itemid.'%') . "' " . |
| | 282 | "LIKE " . $db->escape($itemid.'%') . " " . |
| 283 | 283 | "ORDER BY artist_name_sort"; |
| 284 | 284 | } |
| 285 | 285 | $sh = $db->query($query); |
| … |
… |
function getRandItems($type) |
| 1008 | 1008 | function searchMusic($terms, $option) |
| 1009 | 1009 | { |
| 1010 | 1010 | global $db; |
| 1011 | | $sql_terms = "'%".$db->escape($terms)."%'"; |
| | 1011 | $sql_terms = "CONCAT('%', ".$db->escape($terms).", '%')"; |
| 1012 | 1012 | $query = 'SELECT ms.song_id, ma.album_name, ms.track, mt.artist_name, ms.name, ms.rating, '. |
| 1013 | 1013 | 'SEC_TO_TIME(ms.length/1000) AS length, genre '. |
| 1014 | 1014 | 'FROM music_songs AS ms '. |
| … |
… |
function internalUpdatePlaylist($songs, $count, $length) |
| 1111 | 1111 | $songlist = implode(',', $songs); |
| 1112 | 1112 | |
| 1113 | 1113 | $query = 'music_playlists SET'. |
| 1114 | | " playlist_songs='".$db->escape($songlist)."'". |
| | 1114 | " playlist_songs=".$db->escape($songlist). |
| 1115 | 1115 | ',length='.$db->escape($length). |
| 1116 | 1116 | ',songcount='.$db->escape($count); |
| 1117 | 1117 | |
| 1118 | 1118 | if (empty($plId)) |
| 1119 | 1119 | { |
| 1120 | 1120 | $query = 'INSERT INTO '.$query. |
| 1121 | | ",hostname='".$db->escape('mythweb-'.$_SERVER['SERVER_NAME'])."'". |
| | 1121 | ",hostname=".$db->escape('mythweb-'.$_SERVER['SERVER_NAME']). |
| 1122 | 1122 | ",playlist_name='".MYTH_WEB_PLAYLIST_NAME."'"; |
| 1123 | 1123 | } |
| 1124 | 1124 | else |
| … |
… |
function savePlaylist($pl_name, $newpl) |
| 1252 | 1252 | else |
| 1253 | 1253 | { |
| 1254 | 1254 | $query = 'UPDATE music_playlists SET'. |
| 1255 | | ' playlist_name=\''.$db->escape($pl_name).'\''. |
| | 1255 | ' playlist_name='.$db->escape($pl_name). |
| 1256 | 1256 | ",hostname='' ". |
| 1257 | 1257 | 'WHERE playlist_id='.$db->escape($pl['playlist_id']); |
| 1258 | 1258 | |
| … |
… |
function playlist_move($item1,$item2) |
| 1360 | 1360 | $songs[$idx2] = $tmp; |
| 1361 | 1361 | |
| 1362 | 1362 | $query = 'UPDATE music_playlists SET'. |
| 1363 | | ' playlist_songs=\''.$db->escape(implode(',', $songs)).'\' '. |
| | 1363 | ' playlist_songs='.$db->escape(implode(',', $songs)).' '. |
| 1364 | 1364 | 'WHERE playlist_id='.$db->escape($pl['playlist_id']).';'; |
| 1365 | 1365 | $db->query($query); |
| 1366 | 1366 | } |
