Skip to content

Commit e01f044

Browse files
ywarnierywarnier
committed
Remove Database::escape_string() without quotes to avoid SQL injections - partial - refs #7440
1 parent c5dccb4 commit e01f044

13 files changed

+66
-66
lines changed

‎main/inc/lib/add_courses_to_session_functions.lib.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ public static function search_courses($needle, $type)
3131

3232
$cond_course_code = '';
3333
if (!empty($id_session)) {
34-
$id_session = Database::escape_string($id_session);
34+
$id_session = intval($id_session);
3535
// check course_code from session_rel_course table
3636
$sql = 'SELECT course_code FROM '.$tbl_session_rel_course.'
37-
WHERE id_session ="'.(int)$id_session.'"';
37+
WHERE id_session = '.$id_session;
3838
$res = Database::query($sql);
3939
$course_codes = '';
4040
if (Database::num_rows($res) > 0) {

‎main/inc/lib/blog.lib.php‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ public static function edit_blog ($blog_id, $title, $subtitle) {
165165
$this_blog_id = Database::insert_id();
166166

167167
//update item_property (update)
168-
api_item_property_update(api_get_course_info(), TOOL_BLOGS, Database::escape_string($blog_id), 'BlogUpdated', api_get_user_id());
168+
api_item_property_update(api_get_course_info(), TOOL_BLOGS, intval($blog_id), 'BlogUpdated', api_get_user_id());
169169

170170
// Update course homepage link
171171
$sql = "UPDATE $tbl_tool SET name = '".Database::escape_string($title)."' WHERE c_id = $course_id AND link = 'blog/blog.php?blog_id=".Database::escape_string((int)$blog_id)."' LIMIT 1";
@@ -217,7 +217,7 @@ public static function delete_blog ($blog_id) {
217217
Database::query($sql);
218218

219219
//update item_property (delete)
220-
api_item_property_update(api_get_course_info(), TOOL_BLOGS, Database::escape_string($blog_id), 'delete', api_get_user_id());
220+
api_item_property_update(api_get_course_info(), TOOL_BLOGS, intval($blog_id), 'delete', api_get_user_id());
221221
}
222222

223223
/**
@@ -278,7 +278,7 @@ public static function create_post ($title, $full_text, $file_comment, $blog_id)
278278
// Storing the attachments if any
279279
if ($result) {
280280
$sql='INSERT INTO '.$blog_table_attachment.'(c_id, filename,comment, path, post_id,size, blog_id,comment_id) '.
281-
"VALUES ($course_id, '".Database::escape_string($file_name)."', '".Database::escape_string($comment)."', '".Database::escape_string($new_file_name)."' , '".$last_post_id."', '".intval($_FILES['user_upload']['size'])."', '".$blog_id."', '0' )";
281+
"VALUES ($course_id, '".Database::escape_string($file_name)."', '".$comment."', '".Database::escape_string($new_file_name)."' , '".$last_post_id."', '".intval($_FILES['user_upload']['size'])."', '".$blog_id."', '0' )";
282282
$result=Database::query($sql);
283283
$message.=' / '.get_lang('AttachmentUpload');
284284
}
@@ -404,7 +404,7 @@ public static function create_comment($title, $full_text, $file_comment,$blog_id
404404
if ($result)
405405
{
406406
$sql='INSERT INTO '.$blog_table_attachment.'(c_id, filename,comment, path, post_id,size,blog_id,comment_id) '.
407-
"VALUES ($course_id, '".Database::escape_string($file_name)."', '".Database::escape_string($comment)."', '".Database::escape_string($new_file_name)."' , '".$post_id."', '".$_FILES['user_upload']['size']."', '".$blog_id."', '".$last_id."' )";
407+
"VALUES ($course_id, '".Database::escape_string($file_name)."', '".$comment."', '".Database::escape_string($new_file_name)."' , '".$post_id."', '".$_FILES['user_upload']['size']."', '".$blog_id."', '".$last_id."' )";
408408
$result=Database::query($sql);
409409
$message.=' / '.get_lang('AttachmentUpload');
410410
}
@@ -423,9 +423,9 @@ public static function delete_comment ($blog_id, $post_id, $comment_id) {
423423
// Init
424424
$tbl_blogs_comments = Database::get_course_table(TABLE_BLOGS_COMMENTS);
425425
$tbl_blogs_rating = Database::get_course_table(TABLE_BLOGS_RATING);
426-
$blog_id = Database::escape_string($blog_id);
427-
$post_id = Database::escape_string($post_id);
428-
$comment_id = Database::escape_string($comment_id);
426+
$blog_id = intval($blog_id);
427+
$post_id = intval($post_id);
428+
$comment_id = intval($comment_id);
429429

430430
$course_id = api_get_course_int_id();
431431

@@ -2713,9 +2713,9 @@ function get_blog_attachment($blog_id, $post_id=null,$comment_id=null)
27132713
{
27142714
$blog_table_attachment = Database::get_course_table(TABLE_BLOGS_ATTACHMENT);
27152715

2716-
$blog_id = Database::escape_string($blog_id);
2717-
$comment_id = Database::escape_string($comment_id);
2718-
$post_id = Database::escape_string($post_id);
2716+
$blog_id = intval($blog_id);
2717+
$comment_id = intval($comment_id);
2718+
$post_id = intval($post_id);
27192719
$row=array();
27202720
$where='';
27212721
if (!empty ($post_id) && is_numeric($post_id)) {
@@ -2754,9 +2754,9 @@ function delete_all_blog_attachment($blog_id,$post_id=null,$comment_id=null)
27542754

27552755
global $_course;
27562756
$blog_table_attachment = Database::get_course_table(TABLE_BLOGS_ATTACHMENT);
2757-
$blog_id = Database::escape_string($blog_id);
2758-
$comment_id = Database::escape_string($comment_id);
2759-
$post_id = Database::escape_string($post_id);
2757+
$blog_id = intval($blog_id);
2758+
$comment_id = intval($comment_id);
2759+
$post_id = intval($post_id);
27602760

27612761
$course_id = api_get_course_int_id();
27622762

@@ -2836,7 +2836,7 @@ function get_blog_post_from_user($course_code, $user_id) {
28362836
function get_blog_comment_from_user($course_code, $user_id) {
28372837
$tbl_blogs = Database::get_course_table(TABLE_BLOGS);
28382838
$tbl_blog_comment = Database::get_course_table(TABLE_BLOGS_COMMENTS);
2839-
$user_id = Database::escape_string($user_id);
2839+
$user_id = intval($user_id);
28402840

28412841
$course_info = api_get_course_info($course_code);
28422842
$course_id = $course_info['real_id'];

‎main/inc/lib/classmanager.lib.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ public static function subscribe_to_course($class_id, $course_code) {
160160
$tbl_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
161161
$sql = "INSERT IGNORE INTO $tbl_course_class SET course_code = '".Database::escape_string($course_code)."', class_id = '".Database::escape_string($class_id)."'";
162162
Database::query($sql);
163-
$sql = "SELECT user_id FROM $tbl_class_user WHERE class_id = '".Database::escape_string($class_id)."'";
163+
$sql = "SELECT user_id FROM $tbl_class_user WHERE class_id = '".intval($class_id)."'";
164164
$res = Database::query($sql);
165165
while ($user = Database::fetch_object($res)) {
166166
CourseManager :: subscribe_user($user->user_id, $course_code);
@@ -181,7 +181,7 @@ public static function unsubscribe_from_course($class_id, $course_code)
181181
$single_class_users = Database::query($sql);
182182
while ($single_class_user = Database::fetch_object($single_class_users))
183183
{
184-
$sql = "SELECT * FROM $tbl_class_user WHERE class_id = '".Database::escape_string($class_id)."' AND user_id = '".Database::escape_string($single_class_user->user_id)."'";
184+
$sql = "SELECT * FROM $tbl_class_user WHERE class_id = '".intval($class_id)."' AND user_id = '".Database::escape_string($single_class_user->user_id)."'";
185185
$res = Database::query($sql);
186186
if (Database::num_rows($res) > 0)
187187
{

‎main/inc/lib/course.lib.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -253,7 +253,7 @@ public static function get_courses_list(
253253
if (!in_array($orderdirection, array('ASC', 'DESC'))) {
254254
$sql .= 'ASC';
255255
} else {
256-
$sql .= Database::escape_string($orderdirection);
256+
$sql .= ($orderdirection == 'ASC'?'ASC':'DESC');
257257
}
258258

259259
if (!empty($howmany) && is_int($howmany) and $howmany > 0) {
@@ -263,7 +263,7 @@ public static function get_courses_list(
263263
}
264264
if (!empty($from)) {
265265
$from = intval($from);
266-
$sql .= ' OFFSET '.Database::escape_string($from);
266+
$sql .= ' OFFSET '.intval($from);
267267
} else {
268268
$sql .= ' OFFSET 0';
269269
}
@@ -301,7 +301,7 @@ public static function get_user_in_course_status($user_id, $course_code)
301301
{
302302
$result = Database::fetch_array(Database::query(
303303
"SELECT status FROM ".Database::get_main_table(TABLE_MAIN_COURSE_USER)."
304-
WHERE course_code = '".Database::escape_string($course_code)."' AND user_id = ".Database::escape_string($user_id))
304+
WHERE course_code = '".Database::escape_string($course_code)."' AND user_id = ".intval($user_id))
305305
);
306306

307307
return $result['status'];
@@ -316,7 +316,7 @@ public static function get_tutor_in_course_status($user_id, $course_code)
316316
{
317317
$result = Database::fetch_array(Database::query(
318318
"SELECT tutor_id FROM ".Database::get_main_table(TABLE_MAIN_COURSE_USER)."
319-
WHERE course_code = '".Database::escape_string($course_code)."' AND user_id = ".Database::escape_string($user_id))
319+
WHERE course_code = '".Database::escape_string($course_code)."' AND user_id = ".intval($user_id))
320320
);
321321

322322
return $result['tutor_id'];
@@ -3868,7 +3868,7 @@ function get_user_course_categories() {
38683868
global $_user;
38693869
$output = array();
38703870
$table_category = Database::get_user_personal_table(TABLE_USER_COURSE_CATEGORY);
3871-
$sql = "SELECT * FROM ".$table_category." WHERE user_id='".Database::escape_string($_user['user_id'])."'";
3871+
$sql = "SELECT * FROM ".$table_category." WHERE user_id='".intval($_user['user_id'])."'";
38723872
$result = Database::query($sql);
38733873
while ($row = Database::fetch_array($result)) {
38743874
$output[$row['id']] = $row['title'];

‎main/inc/lib/course_category.lib.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ function addNode($code, $name, $canHaveCourses, $parent_id)
101101
$tbl_category = Database::get_main_table(TABLE_MAIN_CATEGORY);
102102
$code = trim(Database::escape_string($code));
103103
$name = trim(Database::escape_string($name));
104-
$parent_id = Database::escape_string($parent_id);
104+
$parent_id = intval($parent_id);
105105
$canHaveCourses = Database::escape_string($canHaveCourses);
106106
$code = generate_course_code($code);
107107

@@ -220,7 +220,7 @@ function moveNodeUp($code, $tree_pos, $parent_id)
220220
$tbl_category = Database::get_main_table(TABLE_MAIN_CATEGORY);
221221
$code = Database::escape_string($code);
222222
$tree_pos = Database::escape_string($tree_pos);
223-
$parent_id = Database::escape_string($parent_id);
223+
$parent_id = intval($parent_id);
224224
$sql = "SELECT code,tree_pos
225225
FROM $tbl_category
226226
WHERE parent_id " . (empty($parent_id) ? "IS NULL" : "='$parent_id'") . " AND tree_pos<'$tree_pos'
@@ -246,11 +246,11 @@ function moveNodeUp($code, $tree_pos, $parent_id)
246246
* @param $cpt
247247
* @return mixed
248248
*/
249-
function compterFils($pere, $cpt)
249+
function compterFils($parent, $cpt)
250250
{
251251
$tbl_category = Database::get_main_table(TABLE_MAIN_CATEGORY);
252-
$pere = Database::escape_string($pere);
253-
$result = Database::query("SELECT code FROM $tbl_category WHERE parent_id='$pere'");
252+
$parent = intval($parent);
253+
$result = Database::query("SELECT code FROM $tbl_category WHERE parent_id='$parent'");
254254

255255
while ($row = Database::fetch_array($result)) {
256256
$cpt = compterFils($row['code'], $cpt);

‎main/inc/lib/course_request.lib.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ public static function update_course_request(
299299
objetives = "%s", target_audience = "%s", status = "%s", info = "%s", exemplary_content = "%s"
300300
WHERE id = '.$id, Database::get_main_table(TABLE_MAIN_COURSE_REQUEST),
301301
Database::escape_string($code),
302-
Database::escape_string($user_id),
302+
intval($user_id),
303303
Database::escape_string($directory),
304304
Database::escape_string($db_name),
305305
Database::escape_string($course_language),

‎main/inc/lib/document.lib.php‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -983,7 +983,7 @@ public static function is_folder($_course, $document_id)
983983
{
984984
$TABLE_DOCUMENT = Database::get_course_table(TABLE_DOCUMENT);
985985
$course_id = $_course['real_id'];
986-
$document_id = Database::escape_string($document_id);
986+
$document_id = intval($document_id);
987987
$sql = "SELECT filetype FROM $TABLE_DOCUMENT
988988
WHERE c_id = $course_id AND id= $document_id";
989989
$result = Database::fetch_array(Database::query($sql), 'ASSOC');
@@ -1467,7 +1467,7 @@ public static function set_document_as_template($title, $description, $document_
14671467
'" . Database::escape_string($title) . "',
14681468
'" . Database::escape_string($description) . "',
14691469
'" . Database::escape_string($course_code) . "',
1470-
'" . Database::escape_string($user_id) . "',
1470+
'" . intval($user_id) . "',
14711471
'" . Database::escape_string($document_id_for_template) . "',
14721472
'" . Database::escape_string($image) . "')";
14731473
Database::query($sql);
@@ -1486,8 +1486,8 @@ public static function unset_document_as_template($document_id, $course_code, $u
14861486
{
14871487
$table_template = Database::get_main_table(TABLE_MAIN_TEMPLATES);
14881488
$course_code = Database::escape_string($course_code);
1489-
$user_id = Database::escape_string($user_id);
1490-
$document_id = Database::escape_string($document_id);
1489+
$user_id = intval($user_id);
1490+
$document_id = intval($document_id);
14911491

14921492
$sql = 'SELECT id FROM ' . $table_template . '
14931493
WHERE
@@ -1718,13 +1718,13 @@ public static function attach_gradebook_certificate($course_id, $document_id)
17181718
$tbl_category = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY);
17191719
$session_id = api_get_session_id();
17201720
if ($session_id == 0 || is_null($session_id)) {
1721-
$sql_session = 'AND (session_id=' . Database::escape_string($session_id) . ' OR isnull(session_id)) ';
1721+
$sql_session = 'AND (session_id=' . intval($session_id) . ' OR isnull(session_id)) ';
17221722
} elseif ($session_id > 0) {
1723-
$sql_session = 'AND session_id=' . Database::escape_string($session_id);
1723+
$sql_session = 'AND session_id=' . intval($session_id);
17241724
} else {
17251725
$sql_session = '';
17261726
}
1727-
$sql = 'UPDATE ' . $tbl_category . ' SET document_id="' . Database::escape_string($document_id) . '"
1727+
$sql = 'UPDATE ' . $tbl_category . ' SET document_id="' . intval($document_id) . '"
17281728
WHERE course_code="' . Database::escape_string($course_id) . '" ' . $sql_session;
17291729
Database::query($sql);
17301730
}
@@ -1739,9 +1739,9 @@ public static function get_default_certificate_id($course_id)
17391739
$tbl_category = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY);
17401740
$session_id = api_get_session_id();
17411741
if ($session_id == 0 || is_null($session_id)) {
1742-
$sql_session = 'AND (session_id=' . Database::escape_string($session_id) . ' OR isnull(session_id)) ';
1742+
$sql_session = 'AND (session_id=' . intval($session_id) . ' OR isnull(session_id)) ';
17431743
} elseif ($session_id > 0) {
1744-
$sql_session = 'AND session_id=' . Database::escape_string($session_id);
1744+
$sql_session = 'AND session_id=' . intval($session_id);
17451745
} else {
17461746
$sql_session = '';
17471747
}
@@ -1911,9 +1911,9 @@ public static function remove_attach_certificate($course_id, $default_certificat
19111911
$tbl_category = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY);
19121912
$session_id = api_get_session_id();
19131913
if ($session_id == 0 || is_null($session_id)) {
1914-
$sql_session = 'AND (session_id=' . Database::escape_string($session_id) . ' OR isnull(session_id)) ';
1914+
$sql_session = 'AND (session_id=' . intval($session_id) . ' OR isnull(session_id)) ';
19151915
} elseif ($session_id > 0) {
1916-
$sql_session = 'AND session_id=' . Database::escape_string($session_id);
1916+
$sql_session = 'AND session_id=' . intval($session_id);
19171917
} else {
19181918
$sql_session = '';
19191919
}

‎main/inc/lib/events.lib.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1613,8 +1613,8 @@ function event_send_mail($event_name, $params)
16131613
*/
16141614
function check_if_mail_already_sent($event_name, $user_from, $user_to = null) {
16151615
$event_name = Database::escape_string($event_name);
1616-
$user_to = Database::escape_string($user_to);
1617-
$user_from = Database::escape_string($user_from);
1616+
$user_to = intval($user_to);
1617+
$user_from = intval($user_from);
16181618
if ($user_to == null) {
16191619
$sql = 'SELECT COUNT(*) as total FROM ' . Database::get_main_table(TABLE_EVENT_SENT) . '
16201620
WHERE user_from = '.$user_from.' AND event_type_name = "'.$event_name.'"';

‎main/inc/lib/extra_field_value.lib.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,7 @@ public function save($params, $show_query = false)
384384
public function get_values_by_handler_and_field_id($item_id, $field_id, $transform = false)
385385
{
386386
$field_id = intval($field_id);
387-
$item_id = Database::escape_string($item_id);
387+
$item_id = intval($item_id);
388388

389389
$sql = "SELECT s.*, field_type FROM {$this->table} s
390390
INNER JOIN {$this->table_handler_field} sf ON (s.field_id = sf.id)
@@ -466,7 +466,7 @@ public function searchValuesByField($tag, $field_id, $limit = 10)
466466
*/
467467
public function get_values_by_handler_and_field_variable($item_id, $field_variable, $transform = false)
468468
{
469-
$item_id = Database::escape_string($item_id);
469+
$item_id = intval($item_id);
470470
$field_variable = Database::escape_string($field_variable);
471471

472472
$sql = "SELECT s.*, field_type FROM {$this->table} s
@@ -637,7 +637,7 @@ public function delete_all_values_by_field_id($field_id)
637637
public function delete_values_by_handler_and_field_id($item_id, $field_id)
638638
{
639639
$field_id = intval($field_id);
640-
$item_id = Database::escape_string($item_id);
640+
$item_id = intval($item_id);
641641
$sql = "DELETE FROM {$this->table}
642642
WHERE {$this->handler_id} = '$item_id' AND field_id = '".$field_id."' ";
643643
Database::query($sql);

0 commit comments

Comments
 (0)