poweradmin: comparison inc/users.inc.php

equal deleted inserted replaced

-:dab0e9deeb67
+:ce1c4d5e1576
 * return values: an array with all users in it.
 */
 function show_users($id='',$rowstart=0,$rowamount=9999999)
 {
 	global $db;
+	$add = '';
 	if(is_numeric($id))
 	{
 //When a user id is given, it is excluded from the userlist returned.
-$add = " WHERE users.id!=$id";
+$add = " WHERE users.id!=".$db->quote($id);
 	}
 	// Make a huge query.
 	$sqlq = "SELECT users.id AS id,
 		users.username AS username,
 			users.email,
 			users.description,
 			users.level,
 			users.active
 		ORDER BY
-			users.fullname
+			users.fullname";
-	 	LIMIT $rowamount OFFSET $rowstart";
 	// Execute the huge query.
+	$db->setLimit($rowstart, $rowamount);
 	$result = $db->query($sqlq);
 	$ret = array();
 	$retcount = 0;
 	while ($r = $result->fetchRow())
 	{
 function is_valid_user($id)
 {
 	global $db;
 	if(is_numeric($id))
 	{
-		$result = $db->query("SELECT id FROM users WHERE id=$id");
+		$result = $db->query("SELECT id FROM users WHERE id=".$db->quote($id));
 		if ($result->numRows() == 1)
 		{
 			return true;
 		}
 		else
 * return values: true if exists, false if not.
 */
 function user_exists($user)
 {
 	global $db;
-	$result = $db->query("SELECT id FROM users WHERE username='$user'");
+	$result = $db->query("SELECT id FROM users WHERE username=".$db->quote($user));
 	if ($result->numRows() == 0)
 	{
 return false;
 	}
 	elseif($result->numRows() == 1)
 function get_user_info($id)
 {
 	global $db;
 	if (is_numeric($id))
 	{
-		$result = $db->query("SELECT id, username, fullname, email, description, level, active from users where id=$id");
+		$result = $db->query("SELECT id, username, fullname, email, description, level, active from users where id=".$db->quote($id));
 		$r = $result->fetchRow();
 		return $r;
 	}
 	else
 	{
 	{
 		error(ERR_LEVEL_10);
 	}
 	if (is_numeric($id))
 	{
-	$db->query("DELETE FROM users WHERE id=$id");
+	$db->query("DELETE FROM users WHERE id=".$db->quote($id));
-	$db->query("DELETE FROM zones WHERE owner=$id");
+	$db->query("DELETE FROM zones WHERE owner=".$db->quote($id));
 	return true;
 	// No need to check the affected rows. If the affected rows would be 0,
 	// the user isnt in the dbase, just as we want.
 }
 	else
 	{
 		error(ERR_LEVEL_10);
 	}
 	if (!user_exists($user))
 	{
-		// Might have to be changed.
+		if (!is_valid_email($email))
-		// TODO probably.
+		{
-		$description = mysql_escape_string($description);
+			error(ERR_INV_EMAIL);
+		}
-		// Clean up the fullname
-		$fullname = mysql_escape_string($fullname);
+		$db->query("INSERT INTO users (username, password, fullname, email, description, level, active) VALUES (".$db->quote($user).", '" . md5($password) . "', ".$db->quote($fullname).", ".$db->quote($email).", ".$db->quote($description).", ".$db->quote($level).", ".$db->quote($active).")");
-		is_valid_email($email);
-		$db->query("INSERT INTO users (username, password, fullname, email, description, level, active) VALUES ('$user', '" . md5($password) . "', '$fullname', '$email', '$description', '$level', '$active')");
 		return true;
 	}
 	else
 	{
 		error(ERR_USER_EXISTS);
 	global $db;
 	if(!level(10)) {
 		error(ERR_LEVEL_10);
 	}
-	// Might have to be changed.
+	if (!is_valid_email($email))
-	// TODO
+	{
-	$description = mysql_escape_string($description);
+		error(ERR_INV_EMAIL);
-	$fullname = mysql_escape_string($fullname);
+	}
-	is_valid_email($email);
+	$sqlquery = "UPDATE users set username=".$db->quote($user).", fullname=".$db->quote($fullname).", email=".$db->quote($email).", level=".$db->quote($level).", description=".$db->quote($description).", active=".$db->quote($active);
-	$sqlquery = "UPDATE users set username='$user', fullname='$fullname', email='$email', level=$level, description='$description', active=$active ";
 	if($password != "")
 	{
 		$sqlquery .= ", password= '" . md5($password) . "' ";
 	}
-	$sqlquery .= "where id=$id" ;
+	$sqlquery .= " WHERE id=".$db->quote($id) ;
 	// Search the username that right now goes with this ID.
-	$result = $db->query("SELECT username from users where id=$id");
+	$result = $db->query("SELECT username from users where id=".$db->quote($id));
 	$r = array();
 	$r = $result->fetchRow();
 	// If the found username with this ID is the given username with the command.. execute.
 		return true;
 	}
 	// Its not.. so the user wants to change.
 	// Find if there is an id that has the wished username.
-	$otheruser = $db->query("SELECT id from users where username='$user'");
+	$otheruser = $db->query("SELECT id from users where username=".$db->query($user));
 	if($otheruser->numRows() > 0)
 	{
 		error(ERR_USER_EXIST);
 	}
 	{
 		error(ERR_USER_MATCH_NEW_PASS);
 	}
 	// Retrieve the users password.
-	$result = $db->query("SELECT password, id FROM users WHERE username='". $_SESSION["userlogin"]  ."'");
+	$result = $db->query("SELECT password, id FROM users WHERE username=".$db->quote($_SESSION["userlogin"]));
 	$rinfo = $result->fetchRow();
 	// Check the current password versus the database password and execute the update.
 	if(md5($currentpass) == $rinfo["password"])
 	{
 function get_fullname_from_userid($id)
 {
 	global $db;
 	if (is_numeric($id))
 	{
-		$result = $db->query("SELECT fullname FROM users WHERE id=$id");
+		$result = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id));
 		$r = $result->fetchRow();
 		return $r["fullname"];
 	}
 	else
 	{
 function get_owner_from_id($id)
 {
 	global $db;
 	if (is_numeric($id))
 	{
-		$result = $db->query("SELECT fullname FROM users WHERE id=$id");
+		$result = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id));
 		if ($result->numRows() == 1)
 		{
 			$r = $result->fetchRow();
 			return $r["fullname"];
 		}
 function get_owners_from_domainid($id) {
 global $db;
 if (is_numeric($id))
 {
-$result = $db->query("SELECT users.id, users.fullname FROM users, zones WHERE zones.domain_id=$id AND zones.owner=users.id ORDER by fullname");
+$result = $db->query("SELECT users.id, users.fullname FROM users, zones WHERE zones.domain_id=".$db->quote($id)." AND zones.owner=users.id ORDER by fullname");
 if ($result->numRows() == 0)
 {
 		      return "";
 }
 	      else

changeset 65	ce1c4d5e1576
parent 58	78558a77131e
child 67	2f8c29fc5e2e