auth/base: PDO

[tt-rss.git] / classes / auth / base.php

diff --git a/classes/auth/base.php b/classes/auth/base.php
index 69acd0985c6ceb87a173eafa2983a411589a07ff..652b66e6e2d139a64b356abdb6b052c87d081f23 100644 (file)
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -1,15 +1,23 @@
 <?php
 class Auth_Base {
        private $dbh;
+       private $pdo;
 
        function __construct() {
                $this->dbh = Db::get();
+               $this->pdo = Db::pdo();
        }
 
+       /**
+        * @SuppressWarnings(unused)
+        */
        function check_password($owner_uid, $password) {
                return false;
        }
 
+       /**
+        * @SuppressWarnings(unused)
+        */
        function authenticate($login, $password) {
                return false;
        }
@@ -23,15 +31,13 @@ class Auth_Base {
                        if (!$password) $password = make_password();
 
                        if (!$user_id) {
-                               $login = $this->dbh->escape_string($login);
                                $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
                                $pwd_hash = encrypt_password($password, $salt, true);
 
-                               $query = "INSERT INTO ttrss_users
+                               $sth = $this->pdo->prepare("INSERT INTO ttrss_users
                                                (login,access_level,last_login,created,pwd_hash,salt)
-                                               VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
-
-                               $this->dbh->query($query);
+                                               VALUES (?, 0, null, NOW(), ?,?)");
+                               $sth->execute([$login, $pwd_hash, $salt]);
 
                                return $this->find_user_by_login($login);
 
@@ -44,18 +50,15 @@ class Auth_Base {
        }
 
        function find_user_by_login($login) {
-               $login = $this->dbh->escape_string($login);
-
-               $result = $this->dbh->query("SELECT id FROM ttrss_users WHERE
-                       login = '$login'");
+               $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
+                       login = ?");
+               $sth->execute([$login]);
 
-               if ($this->dbh->num_rows($result) > 0) {
-                       return $this->dbh->fetch_result($result, 0, "id");
+               if ($row = $sth->fetch()) {
+                       return $row["id"];
                } else {
                        return false;
                }
 
        }
 }
-
-?>