search_to_sql: leftover tsquery query fix for pgsql

[tt-rss.git] / include / functions.php

diff --git a/include/functions.php b/include/functions.php
index 31a0300d75428733241358be45b306ce1dc20d9f..f1b016de7ecf67e9c9f6353eb91680d63ab78006 100644 (file)
--- a/include/functions.php
+++ b/include/functions.php
@@ -941,19 +941,11 @@
        }
 
        function sql_bool_to_bool($s) {
-               if ($s == "t" || $s == "1" || strtolower($s) == "true") {
-                       return true;
-               } else {
-                       return false;
-               }
+               return $s && ($s !== "f" && $s !== "false"); //no-op for PDO, backwards compat for legacy layer
        }
 
        function bool_to_sql_bool($s) {
-               if ($s) {
-                       return "true";
-               } else {
-                       return "false";
-               }
+               return (bool)$s; //no-op for PDO
        }
 
        // Session caching removed due to causing wrong redirects to upgrade
@@ -985,10 +977,6 @@
                        $error_code = 5;
                }
 
-               if (db_escape_string("testTEST") != "testTEST") {
-                       $error_code = 12;
-               }
-
                return array("code" => $error_code, "message" => $ERRORS[$error_code]);
        }
 
@@ -1065,7 +1053,7 @@
        }
 
        function checkbox_to_sql_bool($val) {
-               return ($val == "on") ? "true" : "false";
+               return ($val == "on") ? true : false;
        }
 
        function uniqid_short() {
@@ -1396,21 +1384,21 @@
                        switch ($commandpair[0]) {
                                case "title":
                                        if ($commandpair[1]) {
-                                               array_push($query_keywords, "($not (LOWER(ttrss_entries.title) LIKE '%".
-                                                       $pdo->quote(mb_strtolower($commandpair[1]))."%'))");
+                                               array_push($query_keywords, "($not (LOWER(ttrss_entries.title) LIKE ".
+                                                       $pdo->quote('%' . mb_strtolower($commandpair[1]) . '%') ."))");
                                        } else {
                                                array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                array_push($search_words, $k);
                                        }
                                        break;
                                case "author":
                                        if ($commandpair[1]) {
-                                               array_push($query_keywords, "($not (LOWER(author) LIKE '%".
-                                                       $pdo->quote(mb_strtolower($commandpair[1]))."%'))");
+                                               array_push($query_keywords, "($not (LOWER(author) LIKE ".
+                                                       $pdo->quote('%' . mb_strtolower($commandpair[1]) . '%')."))");
                                        } else {
                                                array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                array_push($search_words, $k);
                                        }
                                        break;
@@ -1421,11 +1409,11 @@
                                                else if ($commandpair[1] == "false")
                                                        array_push($query_keywords, "($not (note IS NULL OR note = ''))");
                                                else
-                                                       array_push($query_keywords, "($not (LOWER(note) LIKE '%".
-                                                               $pdo->quote(mb_strtolower($commandpair[1]))."%'))");
+                                                       array_push($query_keywords, "($not (LOWER(note) LIKE ".
+                                                               $pdo->quote('%' . mb_strtolower($commandpair[1]) . '%')."))");
                                        } else {
-                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER(".$pdo->quote("%$k%").")
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                if (!$not) array_push($search_words, $k);
                                        }
                                        break;
@@ -1437,8 +1425,8 @@
                                                else
                                                        array_push($query_keywords, "($not (marked = false))");
                                        } else {
-                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER(".$pdo->quote("%$k%").")
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                if (!$not) array_push($search_words, $k);
                                        }
                                        break;
@@ -1451,7 +1439,7 @@
 
                                        } else {
                                                array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                if (!$not) array_push($search_words, $k);
                                        }
                                        break;
@@ -1463,8 +1451,8 @@
                                                        array_push($query_keywords, "($not (unread = false))");
 
                                        } else {
-                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER(".$pdo->quote("%$k%").")
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                if (!$not) array_push($search_words, $k);
                                        }
                                        break;
@@ -1484,8 +1472,8 @@
                                                        $k = mb_strtolower($k);
                                                        array_push($search_query_leftover, $not ? "!$k" : $k);
                                                } else {
-                                                       array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
-                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                                       array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER(".$pdo->quote("%$k%").")
+                                                               OR UPPER(ttrss_entries.content) $not LIKE UPPER(".$pdo->quote("%$k%")."))");
                                                }
 
                                                if (!$not) array_push($search_words, $k);
@@ -1498,7 +1486,7 @@
 
                        if (DB_TYPE == "pgsql") {
                                array_push($query_keywords,
-                                       "(tsvector_combined @@ to_tsquery('$search_language', '$search_query_leftover'))");
+                                       "(tsvector_combined @@ to_tsquery($search_language, $search_query_leftover))");
                        }
 
                }
@@ -2226,6 +2214,8 @@
        function filter_to_sql($filter, $owner_uid) {
                $query = array();
 
+               $pdo = Db::pdo();
+
                if (DB_TYPE == "pgsql")
                        $reg_qpart = "~";
                else
@@ -2238,7 +2228,7 @@
 
                        if ($regexp_valid) {
 
-                               $rule['reg_exp'] = db_escape_string($rule['reg_exp']);
+                               $rule['reg_exp'] = $pdo->quote($rule['reg_exp']);
 
                                switch ($rule["type"]) {
                                        case "title":
@@ -2271,7 +2261,7 @@
                                if (isset($rule['inverse'])) $qpart = "NOT ($qpart)";
 
                                if (isset($rule["feed_id"]) && $rule["feed_id"] > 0) {
-                                       $qpart .= " AND feed_id = " . db_escape_string($rule["feed_id"]);
+                                       $qpart .= " AND feed_id = " . $pdo->quote($rule["feed_id"]);
                                }
 
                                if (isset($rule["cat_id"])) {